Latest / Identity at the Center / #297 - Navigating the Future of Digital Identities with Chris Power

Transcript

#297 - Navigating the Future of Digital Identities with Chris Power · Identity at the Center

0:00
So the way that we've looked at it is, is that we'd look at it
0:04
as a, or at least the way I've been looking at it, I'll say it
0:07
that way is, is that if I have a function that is running on its
0:13
own and it only has one purpose, to basically turn this one
0:17
widget or turn this one wheel and it does it on its own, then
0:21
that's a non, you know, that that's the non, that's non human
0:24
identity, you know, at work. And that that's how we define
0:29
it. So therefore, it's, you know,
0:30
it's the Lambda that goes off and does the thing and then, you
0:34
know, and then you get an end product and it can't do anything
0:36
else other than that one thing. But that's the, you know, that's
0:40
kind of the overall goal. And that's the, you know, that's
0:42
where they access and everything.
0:44
That's kind of the guardrails in which it sits on.
0:47
So Chris, you picked a real easy one for your first topic.
0:51
What do you have for number 2? This is identity at the center
1:01
if it has anything to do with IAM.
1:04
This is the go to podcast now your hosts Jim McDonald and Jeff
1:11
Stedman. Welcome to the Identity at the
1:19
Center podcast. I'm Jeff, and that's Jim.
1:21
Hey, Jim. Hey, Jeff, how are you?
1:23
Oh, not so bad yourself. Not bad for coming live to you
1:27
on a Sunday morning. It is a Sunday morning, that's
1:30
for sure. I think we're both struggling
1:31
with like allergies or colds or something, I don't know.
1:34
Yeah, I, you know, I, I figured by this point of the summer I
1:37
wouldn't have to worry about allergies, but I checked The
1:40
Weather Channel. We're high for ragweed, which is
1:43
probably the thing that hits me the most.
1:47
So I'm like breathing through my mouth.
1:48
So if you hear me gasping, it's because I've been too talking
1:52
too long. But what's a good reminder to
1:55
shut up? What's that?
1:58
That's a good reminder to shut up.
2:00
Yeah, exactly. It's like if I'm gasping for air
2:02
it means I've been talking for too long straight.
2:05
Exactly. Yeah, so scoured LinkedIn last
2:09
night and you know what a what a treasure trove of ideas.
2:16
One thing that I, I got into was an article about the Oklahoma
2:22
mobile driver's license. That wasn't even on my radar,
2:26
right? Oklahoma's now moving forward
2:29
the mobile driver's license. I feel like every state at some
2:32
level is moving forward with mobile driver's license.
2:35
And it definitely feels like it's in the lane of digital
2:39
identity, don't you think? Well.
2:41
Yeah. I mean, you're, you're
2:42
presenting a credential to say this is who I am.
2:44
That is absolutely digital identity.
2:46
Yeah, it's a new area. I think that a lot of us are,
2:50
you know, needing to learn. So this goes back to the digital
2:54
identity versus IAM. You know, our foundation was
2:57
more in the IAM space, which included customer IAM, so
3:02
internal, external. But now there's this new newer
3:05
area around like decentralized identity, blockchain, stuff like
3:09
that, where, you know, most of us haven't specialized in, but
3:13
understanding not only the use cases, but also the technology.
3:17
I think is, is, is a real, you know, challenge, but
3:22
opportunity. I kind of feel like overall,
3:24
that's the that's the thing in the digital identity space is
3:28
what makes this feel so exciting is the challenge is, is while
3:33
you constantly things are coming up and things are moving forward
3:37
where you're having to, to learn and figure things out.
3:41
But that's also the exciting part is that it doesn't sit
3:44
still and it's not static and we're having the opportunity to
3:49
learn all these new things. Yeah, I mean, that's, I think
3:52
that's the natural evolution of any, of any role anywhere.
3:56
Anytime things move forward, you got to stay current.
4:00
Unless you're a COBOL or mainframe programmer, apparently
4:03
you can like do that work and then like go away for a while
4:06
and then come back and make a ton of money because nobody
4:08
knows how to do it anymore. Exact Well, that's that's the
4:11
key as well as like sometimes sitting still can work to your
4:14
benefit, but I don't know, that's never been my personality
4:18
style. So yeah, but I, you know, we
4:22
always talk about our conference discount codes.
4:25
I think we should get into that in a minute.
4:27
But that's a great way to stay current too, is just going to
4:30
those conferences. You know, we always talk about
4:32
the hallway conversations and that's such a great value.
4:35
But actually sitting in the sessions and seeing how people
4:38
are solving some of these new use cases for identity is a way
4:44
to stay current. And so, you know, to the extent
4:47
that you know, you can afford to be afford to take the time,
4:51
spend the money to be out of conferences, especially looking
4:54
for events that are local to you or local enough that it's not a
4:58
major expenditure, I think it's great.
5:01
And of course, you know, having a company that supports that is
5:05
great as well. You know, our guest today kind
5:08
of ties together the two points I was making because we see him
5:11
in a lot of conferences. So obviously his organization
5:14
has seen the value, sees the value in sending him to
5:19
conferences. And that's how we've, you know,
5:22
built a contact and I, I think a friendship as well.
5:27
But also, you know, just the idea of like being out of
5:33
conferences and, and learning all these new topics and then
5:37
taking the position of, you know, wanting to share that
5:40
information with the rest of the community.
5:42
So I think that's, you know what you get all the conferences.
5:46
Yeah, Let's talk about those conference discount codes.
5:48
We've got Identity Week. We've got the America and the
5:50
Asia conference both coming up here.
5:52
You and I are going to be at the Identity Week America in
5:55
Washington, DC on September 11th and 12th.
5:58
We're going to be doing podcast stuff, but I'm actually also
6:00
hosting like an hour of identity and access management talks and
6:05
the panel and stuff like that. So still working through the
6:08
details on that, but I have volunteered to do that.
6:11
So if you use the Code Ida C30, you get 30% off of your
6:16
registration. And that code works for both the
6:17
US and the Asia shows. So if you're going to one or
6:20
both, feel free to use that code.
6:22
Good Freeway to save some money and show support for the show.
6:26
The other one we've got coming up is the authenticate
6:28
conference from the Fido Alliance that is October 14th
6:31
through the 16th in Carlsbad, CA, which awesome weather.
6:35
Love it. We were there last year and I
6:37
think we've been to the last few authenticates at this point, but
6:39
we have a discount code for that one as well.
6:41
ID AC15I D AC15 gets you a 15% off of your registration.
6:46
So you and I are going to be at that one too.
6:49
I know there's a meeting, I think, I think we had to
6:50
reschedule a couple times, but there's one probably next week
6:53
to kind of talk through a little more kind of what we're going to
6:55
be doing, some of the ideas we had for for doing shows there,
6:58
but. Looking forward to Andrew
7:00
Schicchiar as the guest on an upcoming episode.
7:02
I think the next episode. Yeah, I think he's the reigning
7:05
champion right now on number of, you know, appearances on this
7:09
and. We had him on during our dinner
7:12
verse. We had him on during our dinner
7:13
verse, and I think that was #8 so he's looking at episode #9 so
7:18
it's not only in the lead, but he's got a couple.
7:21
He's lapped people a few Times Now.
7:23
Well, he, well, you know, Saturday Night Live does like a,
7:26
you know, five timers club with like a, you know, like a smoking
7:28
jacket type thing. And you're all about those, you
7:31
know, flashy jackets. I want to know what you're going
7:34
to do for if someone makes it to 10 episodes on what, what are we
7:38
going to do about that? Take one of my class jackets and
7:42
and throw an identity at the center sticker on it.
7:47
That's that is a gym answer if I've ever heard one.
7:50
That's weak soft, right? All right, well, we can come up
7:53
with something. Come up with something.
7:55
That all right. Well, why don't we get to our
7:58
main topic and our main and only guest today, I guess his name is
8:02
Chris Bauer. He's a senior manager of
8:04
identity and access management at Sallie Mae.
8:05
He's been with us before all the way back an episode 162 where I
8:10
believe that's the first time at least I remember meeting Chris
8:14
and we had a nice little kind of conversation up in the suite
8:19
suite. If you remember that at Gartner
8:21
at was at Caesar's a few years back.
8:23
Got to know got to know Chris a little bit.
8:25
But welcome back to the show, Chris.
8:27
We'll say thanks, Jeff. Yeah.
8:28
And I'll say it's it. It's been a long ride, but it's
8:31
been a fun ride for the last two years.
8:33
Getting, you know, getting, you know, going from that and
8:35
getting to know you, you know, getting to know you too.
8:37
And of course the the identity space A lot better over the last
8:39
two years through those conferences.
8:42
Yeah. And Speaking of conferences,
8:43
this is actually technically your third appearance on the
8:47
show because you, when we were at the Ideniverse conference
8:51
earlier this year, we had kind of like AQ and A with Andrew
8:53
Shikiar asking some questions about password lists and, and
8:56
authentication, just Fido in general.
8:58
And I believe you stepped up the microphone in our little kind of
9:01
area that we're recording and actually asked a question.
9:03
So if you recognize the voice, there you go.
9:06
You This is technically your third time on the show.
9:08
I'm shooting for 10. I'm shooting for 10, Jeff.
9:11
I want, I want to, you know, I want to get AI want to get a
9:13
jacket. That's that's when you know,
9:14
that's my goal now. You want Jim's leftover jacket
9:17
with a hastily applied identity center sticker applied to it.
9:22
A marker of writing #10 on the back.
9:25
That's right, Chris. People in the US might be
9:30
familiar with Sallie Mae, but I always like to talk about, you
9:34
know, we're talking about this as a global audience.
9:36
Not everyone's familiar with what Sallie Mae does.
9:38
Why don't we start with that? Tell us a little bit about what
9:41
Sallie Mae does, and then I'd love to just kind of hear about
9:44
your role at Sallie Mae. You know, what does a senior
9:47
manager of Identity and access management do for an
9:49
organization like that? Well, Sallie Mae is a, you know,
9:53
Sallie Mae is a private student loan provider.
9:55
We, you know, we help, you know, we help individuals get through,
9:58
you know, get through their journey of, you know, getting a
10:00
better education through various, you know, through
10:03
various colleges and universities by providing ways
10:06
to get, you know, ways to get you, your, you know, the funding
10:08
that you need to get from, you know, from one point in your
10:11
journey to the next. From from an IAM standpoint, you
10:15
know, standpoint, what I've been doing and what, you know, what I
10:18
work with primarily is the, is on the inside of the house, the
10:21
workforce management side of Sallie Mae.
10:24
So everything from the B to B to B and to the individual
10:28
employees to contractors that we use on a day-to-day basis,
10:32
helping manage the, you know, helping manage their access is
10:35
kind of is my, you know, is my bread and butter is what I focus
10:38
on on a day-to-day basis. As a senior, you know, as a
10:41
senior, you know, IAM operations manager, my role is to help
10:46
manage a team of roughly 10 people who spend their days
10:50
taking care of that, what I call the pillars of IAM from a
10:53
workforce management side of things.
10:55
That's, that's the governance of the house, you know, doing, you
10:58
know, doing regular access certifications on a quarterly
11:00
basis, taking care of, you know, taking care of the day-to-day
11:04
provisioning of access joiners, movers, levers, all the, you
11:08
know, basically through the entire life cycle.
11:11
As well as taking care of just, you know, overall, just
11:15
day-to-day aspects of what the workforce needs to be able to
11:19
get into their, you know, to be able to get into their
11:21
individual applications. Helping, you know, helping our,
11:24
you know, helping our teams, you know, make those connections
11:27
between new vendors and new applications, getting them, you
11:30
know, getting them on boarded into our systems.
11:33
So Chris, you, you're actually, you're really living the
11:36
identity and access management life, right?
11:39
So you're, you're in there and I saw your LinkedIn post last
11:44
night, actually, I'm not sure how old it was at that point,
11:48
but you're out there now committing to blog about
11:54
identity access management topics for the betterment of
11:57
kind of like paying it forward, right?
12:00
I think it's the, the right, the, the fancy way to say it
12:03
these days, getting this, you know, at least your opinions out
12:07
there on many different topics. You started with your first
12:11
blog, which is kind of just saying, I'm going to do this
12:13
thing. So now the commitment's out
12:15
there and I hit you up and said, Hey, the commitment's out there.
12:18
How would you like to come on the Identity Center podcast and
12:22
kind of talk about what some of these topics we can expect to
12:26
see you blogging about? So maybe you could kind of walk
12:30
us through a few of those. Let's start with the first one.
12:32
What what's the hottest topic that you have in mind for for
12:35
blog #1? So blog number one, I think is
12:39
going to be around maturing the non human identity that, you
12:43
know, we, you know, we've been going through a quite a process
12:46
lately and been talking about it a lot internally for the, you
12:50
know, for last several months, really through a little over a
12:53
year on how to properly manage and maintain a, you know, you
13:00
know, a listing of all of our access that doesn't belong to a
13:04
human being, doesn't actually, you know, isn't connected to a
13:07
contractor or an an employee here at Sally.
13:11
With that. We've, you know, we've had, you
13:14
know, we've actually had our own database that we've been using
13:16
for quite some time to basically kind of we've homegrown our own
13:19
system, so to speak, to basically take care of that for
13:21
the, you know, for the, you know, for the last several
13:24
years. And lovingly we would like to,
13:27
you know, we would like to kind of put that to bed and actually
13:31
try to see what the next level of, you know, what the next
13:33
level of that looks like. So much like when we, you know,
13:36
when we saw each other at a dinner verse that's, that was
13:38
kind of one of my main purposes of being there was, is to stroll
13:41
the vendor hall and kind of get, you know, you know, get a better
13:45
feeling of what, what was out there in that space.
13:48
And what I found was, is that it's, it's a lot more mature
13:53
than I thought it was. But yet I also, yeah, but
13:56
talking to them, I also recognize that there was a lot
13:58
of room for, you know, that they, they all know that there's
14:01
still a lot of room for growth. There's still a lot of room for,
14:04
for standardization and for governance around it.
14:08
And that's, I'm going to say that's what I've been, you know,
14:10
really that's what I've been researching lately.
14:12
And that's kind of that's where my, you know, that's where my
14:14
next set of articles are going to go towards is, is basically
14:17
that research and kind of the, you know, what I've acknowledged
14:19
or what I picked up to, like Jim said, pay it forward.
14:24
So in, you know, in line with that, you know, Jim, I'm going
14:27
to kind of throw this back at you a little bit.
14:29
When you think about non human identity, what do you you know?
14:32
What do you think is probably the most important things to
14:35
look forward to or look into? So you're talking about the the
14:39
non identity space right at the moment.
14:41
So, you know, I want to first kind of put put on the table a
14:51
thought that I've been having recently, which was around this
14:54
crowd strike outage that we all kind of like experienced at some
14:59
level. And I'm not sure how how badly
15:01
that hit you. But one thing that I thought
15:04
about is that we have all these machines now going out and
15:07
performing updates. And it got me thinking about,
15:10
you know, the the whole SolarWinds thing that happened
15:13
or was it a year and a half two years ago now where we have
15:18
powerful machine accounts in the environment that we just say,
15:23
OK, they have a legitimate requirement to exist and they do
15:27
these things. And so from an identity and
15:30
access management standpoint, we say they're legitimate and the
15:35
business tells us they need them.
15:36
So we're OK with that. And that's that.
15:42
I think as cybersecurity professionals as a whole, we
15:47
need to know what our risk is relative to those items right to
15:53
those non human accounts. I don't know that we necessarily
15:58
have the technology right now to catch something like that on the
16:02
fly, to necessarily have controls that could prevent a
16:09
solar gate or prevent what happened with crowd strike.
16:13
But I certainly think we need to do a better job of inventory
16:17
where our risks are relative to these accounts.
16:21
I don't think that a lot of people even understand all the
16:25
accounts that exist and you know, have a way to kind of
16:29
like, all right, well, you know, it again, it's kind of like what
16:34
I say is it's hard to manage what you can't measure.
16:37
Do we have that measurement of those accounts of the risk
16:41
relative to these powerful non human identity accounts?
16:45
So I think that's one big topic that I've been thinking on that
16:50
I'm out there looking for. You know, people tell me, no,
16:54
you're wrong, Jim, we are doing that or that's not important to
16:57
do or yes, you're right. That is something we need to get
17:02
our arms around and here's a framework for doing it.
17:06
I think the second thing overall that makes non human accounts,
17:11
you know, one of the things we keep hearing in the industry is
17:13
that non human accounts now outnumber human accounts.
17:17
So I think you're very much on to a a topic that is, you know,
17:22
absolutely critical. And I don't see that going back
17:25
the other way. I only see you getting, you
17:28
know, bigger and becoming bigger and bigger of a problem to solve
17:32
in terms of we're doing more and more automation and that
17:36
requires more and more non human accounts that can go about, you
17:41
know, carrying out these activities.
17:43
And so I think you have the traditional Windows service
17:47
accounts. And if what I'd encourage people
17:50
to do is like not look at like that as the entire problem
17:56
because I'm, you know, I feel like in the past I gained access
18:00
management and said, OK, you've got these Windows service
18:03
accounts and that's 75% of the problem.
18:05
And then you've got these applications in Linux situations
18:09
where, you know, maybe somebody hard coded an account and it's
18:13
like that's 10 year old thinking.
18:15
You've got to also think now about the whole DevOps
18:18
environment and how accounts are being used to build
18:22
infrastructure and deploy applications and what is the
18:26
risk of those accounts and then robotic process automation.
18:31
So there there's just like a much bigger picture of non human
18:36
accounts. And I think the the first thing
18:38
is really understanding the landscape and then the second is
18:43
understanding the use cases for those accounts and then applying
18:48
controls in a proper way. So I'll stop there and kind of
18:52
see what what Jeff is thinking. But this isn't a new problem.
18:56
These accounts have been here forever.
18:58
Since the dawn of IT, there's been service accounts.
19:03
I think yes, it's going to get peril for 8:00, but to I don't,
19:09
I just don't see this as a new problem.
19:10
This is this is forever now, the technology has probably gotten
19:14
better to the point where it's easier to manage and track these
19:17
things. But I still believe this is a
19:19
governance first issue. These didn't just start popping
19:24
up when AI was invented, right? Or things like that.
19:27
There's been service counts for, for as far back.
19:30
I think this is where we fall back on policy and standards and
19:33
procedures to say, OK, we've created a service account.
19:36
Here is the purpose for it. Do we have good metadata around
19:39
it? Who's responsible for it?
19:41
You know, is it being used for its intended purpose or did we
19:45
share it and use it for another service that, oh, this looks
19:48
like it's similar. You know, let's let's just reuse
19:50
it for that kind of thing. I'm hopeful that some of these
19:53
new technologies in the non human identity space will be
19:55
able to dissect that a little bit, but I find that really
19:59
difficult onion to kind of peel to say, OK, you know, how is it
20:04
going to know who it really belongs to?
20:05
Right? There's no human identifier tag
20:07
to it. You're going to have.
20:08
You're still going to have to go through a process.
20:10
To say, OK, Chris, you've got these, you know, 50 different
20:13
service accounts that you're using to run your, your
20:16
applications or your services and your environment.
20:18
Tell me about them. What do they do?
20:20
Are they scoped correctly from a permission standpoint?
20:23
Or did we just say, well, let's give them domain admin and they
20:26
can do whatever they want. So I think there will be a lot
20:29
of business conversations and helping the business and the
20:34
business in this case might be IT understand, you know how what
20:40
you know, what is the risk associated with these accounts?
20:42
What are you using them for? Do we still need them?
20:46
Because a lot of times these service accounts or other types
20:48
of non humanity stick around forever because we're afraid to
20:52
remove them or disable them because oh, it might break
20:54
something. And the next thing you know,
20:56
you've got a whole bunch of little, you know, micro
20:58
perforations in your identity wall where if one of these
21:01
accounts were to get breached, you'd be able to come through
21:03
and do whatever you need to do. So I, it is interesting, I think
21:06
this is a topic that is definitely becoming more
21:10
important, especially with, you know, the more automation we do
21:12
some things. But I'm curious to see, Chris,
21:14
where, where do you think this is heading?
21:16
And if you've seen any specific products or things like that,
21:19
that or capabilities, maybe that might be like, Oh yeah, that's I
21:23
need that to to make my program more effectively.
21:27
If I could, Jeff, I just wanted to follow up with one other
21:29
point that I forgot to mention, which is, you know, service
21:33
accounts traditionally have weak authentication controls, right?
21:38
They're not eligible for multi factor authentication.
21:42
So if somebody could enter the network with those accounts,
21:47
that's a big problem. And then of course, they have
21:49
very simple passwords that you know, if you're relying on
21:54
password only or certificate only, but let's say password
21:59
only, you know, you've got to make that as difficult and not
22:05
guessable as possible and be rotating those passwords if
22:10
possible so that no human being, it was the even within your
22:14
organization knows the password. So I agree with everything that,
22:18
you know, that Jim and Jeff, you're saying they're going to
22:20
say we're definitely, you know, we're definitely taking a look
22:23
at it from a governance point of view first, you know, first and
22:26
foremost to kind of go along with what Jeff was, you know,
22:28
talking about. We've been, you know, I've been
22:30
doing research. There's, you know, you know, not
22:33
the name drop too much, but like on LinkedIn, there's actually a
22:36
non human identity organization that's kind of being founded,
22:40
you know, founded out there. They have their own website that
22:42
basically kind of is, is beginning to bring awareness up
22:45
to, you know, up on what what a non human identity is and how to
22:49
kind of how to start building controls around it.
22:52
And I, you know, I really appreciate what they, you know,
22:54
the work that they've been doing as well as I think that NIST
22:58
actually is beginning to take their first swings at it to
23:01
trying to, you know, trying to get, you know, trying to get the
23:03
details down of what, you know, a what up a not they call it, I
23:07
believe they call it an NPEA non person, you know, entity is and
23:12
try to go in, try to get into that.
23:14
So there's been, you know, that's the research that I've
23:16
been looking into on that end, as well as knowing full well
23:19
that the, you know, the auditors, you know, the auditors
23:23
and the GRC groups that we work with are very, very, very
23:26
interested in trying to, you know, trying to figure out how
23:28
to, how to say that, you know, how to build controls around it.
23:32
In the sense of saying, can we get to the points of an, an
23:36
application identity only having one, one select purpose.
23:40
So therefore, you know when it, you know when it kind of leaves
23:43
its boundaries or leaves its area of expertise or it gets
23:46
over scoped or overused in some way.
23:48
Again, bringing us back to identity and that into the whole
23:51
space of least privileged. How do we just cut, How do we
23:53
keep it in its own swim lane to keep it going?
23:56
Hey Chris, let me follow up with one more thing because you just
23:58
trigger something. So you talked about governing
24:02
these non human identities, which brings me to the question
24:05
is, is there such a thing as a non human identity?
24:11
And I think most people answer the question yes, but is it a
24:15
non human identity or they're non human accounts?
24:19
Because from a governance standpoint, I think somebody's
24:22
got to own these accounts. I don't really think they are
24:26
identities. I think identities are like the
24:29
people process. And and now maybe with AI we get
24:33
into the point where there's actually intelligence enough to
24:35
you say, OK, that's an identity. It can do the activities that a
24:40
human being would do an intelligent enough way to say
24:44
yes, this account is still required.
24:45
Yes, that is still least privilege for this account, but
24:50
I think that's what an identity does.
24:51
I think an account is really what we're what exists for the
24:56
most part today and those accounts or the process that
25:00
creates those accounts needs to be owned by human being.
25:04
What are your thoughts are? I absolutely agree.
25:08
I mean, the way that we, you know, the way that we currently
25:10
manage them and the way we're, we'll manage them in the future,
25:12
absolutely that there will be owners involved and, you know,
25:15
owners for each of those individual applications, be it
25:18
an IT business owner or an IT technical owner in some way.
25:22
You know, and, and they do, you know, and they get, they get
25:25
applied through certification processes just like it, you
25:28
know, just like any, you know, any other account that we, you
25:30
know, any other account that we handle.
25:31
So they they get reviewed for what they can do.
25:35
So I have for topic. Number hold on.
25:37
I I slightly disagree here. So I think absolutely any
25:43
account can have an identity associated with it.
25:45
So if we're talking about a, let's just call it machine
25:48
account, right? Non human, it's in the name non
25:50
human identity. This is what we're talking
25:51
about. So we're saying, OK, this
25:54
account belongs to some entity that is performing some sort of
25:58
transaction or action. That entity can be human or
26:03
cannot be human. And in the case of a non human
26:06
entity or identity that we we definitely need to have
26:10
ownership assigned to that. But I don't know if it's
26:12
necessarily a person. It may be another entity that is
26:16
responsible for that account. IT is responsible for this non
26:22
human identity. The identity and access
26:24
management team is responsible for this specific identity or
26:28
marketing or e-commerce or whatever it may be.
26:31
And I think as these non human identities start to evolve and
26:35
become more, well, dare I say it, self aware, there may be
26:39
some associate with that to say, OK, well Cortana, right, let's
26:43
call it that or the Microsoft parlance.
26:45
If you're a Halo fan or whatever, you know, there's
26:47
probably a whole bunch of different service accounts that
26:50
run underneath the non human identity called Cortana.
26:54
Now Cortana might belong to, you know, an IT organization or an
26:59
AI department within it. So I, I can see the argument to
27:03
be made to say, no, these are these are identities.
27:06
The it's just that we have to wrap our head around a different
27:08
way to think about it. It's not just human or or non
27:11
human. It's there is an account.
27:14
What is its identity? Certainly if we don't have a
27:17
strategy around it, it, you know, just might be a loose
27:19
collection of accounts that are just, you know, these belong to
27:21
IT. You whoever runs Active
27:23
Directory, here you go. You guys figure it out, right.
27:26
But I can I, I can I feel like I have to make the case for we
27:30
need to think about this more strategically in broader terms,
27:32
OK, we're talking about logical constructs here, an identity, an
27:38
account, you know, ownership or responsible party, right?
27:41
Things like that. And it is.
27:43
I don't always see a one to one match that it's human to non
27:46
human or vice versa. So the way that we've looked at
27:50
it is, is that we look at it as a, or at least the way I've been
27:54
looking at it, I'll say it that way is, is that if I have a
27:59
function that is running on its own and it only has one purpose
28:04
to basically turn this one widget or turn this one wheel
28:07
and it does it on its own, then that's a non.
28:10
You know, that that's the non that's non human identity get
28:13
you at work. And that that's how we define
28:17
it. So therefore it's, you know,
28:18
it's the Lambda that goes off and does the thing and then, you
28:22
know, and then you get an end product and it can't do anything
28:24
else other than that one thing. But that's the, you know, that's
28:28
kind of the overall goal and that's the, you know, that's
28:30
where they access and everything.
28:32
That's kind of the guardrails in which it sits on.
28:35
So Chris, you picked a real easy one for your first topic.
28:39
What do you have for number 2? Well #2 I want to say I would be
28:45
interested in hearing more about the another topic that's, you
28:50
know, top of mind to me is, is, is the identity, is the IAM
28:56
space moving away from RBAC? Is RBAC something that I, I
29:02
recognize that RBAC is going to be around for quite some time.
29:05
This is not like, you know, I forget, I forget the particular
29:09
tool like, you know, you know, Samuel that, that we talked
29:12
about is getting ready to die or Samuel's dead when we, when we
29:15
go to the EI Identiverse. But instead of that, you know,
29:18
instead of in that instance, is the hourglass turned over on our
29:23
back in which we are now kind of working our way to sunsetting
29:26
our back. Are we at the beginning of that
29:28
and moving towards a policy, you know, moving more towards a
29:31
policy access control instead? Personally, what I run into is,
29:36
is that, you know, is what I run into is, is that we've been too
29:41
connected and too heavily reliant on our, for example, HR,
29:46
you know, basically our HR systems and our HR data.
29:49
So therefore it is, it's great that you know that, that is the
29:53
beginning of, you know, identity.
29:55
But using, you know, but using that, you know, using that
29:59
identity information as kind of the foundational layer has
30:03
become, has become more challenging because HR systems
30:07
and HR groups and benefits groups and all the other groups
30:12
that are out there that basically interact, that
30:14
interact with that data have decided to start architecturing
30:17
it differently. Have, you know, have started
30:19
using it in different ways and have put a different lens on it.
30:22
So I, you know, so when they decide to make big sweeping
30:27
changes, it affects my, you know, it affects my R back.
30:31
So therefore, at this point, I'm looking at it more in a curious
30:35
state of should we, you know, should, you know, has the
30:39
industry kind of acknowledged that, you know, those things do
30:41
happen or those things are beginning to happen and maybe we
30:45
should start bread crumbing? Basically our policy, you know,
30:48
our policy engine to, you know, to basically take care of these
30:51
things instead. Sure, still use that, that
30:54
workforce management application or that human, you know, human
30:58
resources, you know, data that comes in, but use it as a
31:01
metadata or use it as an attribute on top of it to or as
31:05
a, you know, as a, as a note to it to be able to say, OK, if
31:09
you're, you know, if you belong to this department, you get this
31:12
limited amount of access and then you work for this manager,
31:15
you get this little bit more access.
31:18
And then your title says this. OK, you get this.
31:22
Now that you have those things, then we start talking about the
31:24
denies. We start talking about because
31:27
you have you, because you are in these departments and in these
31:29
things, maybe you don't need to see all this other types of
31:32
access that's out there and maybe you shouldn't because of
31:35
toxic combinations, you shouldn't be able to get into
31:37
these things at all either. I'm curious if you're seeing
31:40
more growth in that space? I think the the RBAC hourglass
31:47
has been perpetually tipped on its side, cracked with little
31:51
pieces of sand falling out of it for a very long time.
31:55
I can't think of too many IAM constructs that have such a, a
32:02
positive that could have a positive thing on access that
32:06
has been so poorly implemented and just addressed by not only
32:11
the market, but the organizations that try to
32:13
leverage as well. I see so many organizations that
32:15
struggle with RBAC in general because it's become way too
32:19
complicated for organizations to actively, you know, perform the
32:26
exercise of creating the roles in a way that makes sense, is
32:31
scalable, and they can actually keep up with it.
32:34
Most organizations that I've talked to and I've seen got down
32:37
the road of maybe six months to a year into it and we're like,
32:41
oh, this sucks, forget it, go do something else.
32:44
So I think there are, and I think this is, this is where
32:46
things like policy based, attribute based, you know, other
32:50
types of, you know, back have come along to try and fill in
32:54
the cracks around this. The, the, the idea of RBAC
32:58
sounds great on paper until it hits the real world and you have
33:01
a real organization that has hundreds of applications,
33:05
hundreds of different types of metadata available at your
33:09
people, job titles, you know, physical location, you know, job
33:15
codes that don't match with titles.
33:17
The, you know, the organization doesn't recognize the difference
33:20
between a manager, a supervisor or a director or an analyst in
33:23
one for or one part of the, of the company versus an analyst in
33:27
another. And So what are you left with?
33:30
You're left with these alternatives to try and fill in
33:33
the cracks or on RBAC. Now when I look at RBAC, I
33:36
think, OK, that's a great, that's a great goal to have, but
33:39
why don't we start with something easier like attribute
33:41
based? Are you an employee or not?
33:45
That should be hopefully a very simple question and answer.
33:48
Sometimes it's not. But can we at least agree on who
33:52
is an employee versus a, you know, a contractor or a customer
33:57
or whatever that, you know, the persona might be?
34:00
And I think if you can layer different attributes together,
34:03
then he had a little bit better chance of starting to put
34:05
together a axis control model that is actually effective,
34:10
scalable, and an IM or an IT team who's responsible for this
34:14
type of stuff can actually live with it.
34:16
So I feel like this is a soapbox I get on a lot, but I, I, I just
34:21
feel like RBAC is one of the, you know, under underutilized
34:26
because it was so difficult and such a good idea.
34:28
And the promise was, well, I'm just going to put my IJ tool in
34:31
there and it's going to do role scanning for me and fix all this
34:34
for us. I haven't seen it work that
34:36
well. And I live and breathe this
34:38
stuff all the time. So I, I feel like that's my, my
34:41
two cents on it. So I'm going to stop off my
34:42
soapbox and ask Jim what he thinks.
34:45
I think authorization is a difficult topic.
34:48
I mean, you know, authentication used to be a difficult topic,
34:53
right when you had all these web applications and FAT
34:56
applications and, you know, they were using different
35:01
technologies for managing authentication.
35:05
Different authentication was being mixed with coarse grained
35:09
authorization. And then along came Samuel and
35:14
it just became a standard that it was just easier to live by,
35:17
like let's get people into the application, then let the
35:20
application handle authorization.
35:23
So now, now we kind of think authentication is way easier
35:29
than authorization. And I do, I think even before
35:33
Samuel that was true. Now when you take authorization,
35:37
you have some applications where it's like there's a list of
35:41
finite, a finite list of roles and you put a person into those
35:45
roles. Then you have other applications
35:47
take your ERP platforms or take custom built applications where
35:52
the authorization model is tremendously complex.
35:56
Now, you know, when you take something like RBAC, which, you
36:01
know, I think our tendency is to say, well, how can I solve all
36:06
this problem with RBAC? And I don't think that's the
36:09
answer, but I do think there is a place for RBAC.
36:12
I think especially for, and I think RBAC and ABAC, they kind
36:17
of combine because you can get into the same conversation with
36:20
what Jeff was saying is like, are you an employee or not?
36:23
Well, you can create roles that trigger off of that attribute in
36:28
your IGA system, for example, and say, all right, we're
36:31
getting the this feed from the HR system that you are
36:35
employees, we're going to create a role called employees and
36:38
we're going to provision certain birthright access for employees.
36:43
So I still think whether it's ABAC or RBAC, it kind of
36:46
accomplishes the same thing. But when it gets to some of
36:50
these real complex applications, I think the the utility of RBAC
36:55
breaks down. Now could PBAC help solve this
37:00
problem? Potentially.
37:04
But I think even when you get to these BERP systems really
37:10
becomes a matter of people caring about homogenizing the
37:17
different types of access that can be provision, right, So that
37:23
there are different types of people within that system.
37:27
So you can get closer to that finite list of roles rather than
37:32
everybody having an ad hoc, you know, access to that
37:38
application, an ad hoc compilation of attributes and
37:43
permissions within that app. As long as you're allowing that,
37:46
I don't think any back model will really work.
37:52
So it it the hard work is also on the application or platform
37:57
side in terms of homogenizing authorization so they can fit
38:03
some type of model. So you say homogenizing
38:06
application that you know, the obligations together.
38:09
My curiosity there kind of peaks a little bit because with the
38:14
new with SAS applications and with all the different
38:16
applications coming in from different areas, it's
38:20
homogenizing doesn't seem to be the thing that is happening.
38:23
You know, they're, they're, that's the part that we're
38:26
that's the part that we're missing.
38:28
I you know, there we spend a, you know, we've been working on
38:31
RBAC for six plus years at this point.
38:34
We, you know, and been, you know, been building it out as
38:36
best we can and it's, it always still comes down to you will
38:42
know that application doesn't, you know, doesn't have that type
38:45
of granularity to it. It's that's not an option.
38:47
So there's a, there's a balancing act that has to happen
38:50
between systems that allow you to handle front door access
38:54
essentially that that that, you know, that entry level access to
38:58
the application. But then does doesn't have the
39:02
APIs or doesn't have the connectors to do individual, you
39:06
know, to get into the granularity, you actually have
39:08
to go to the you actually have to go to a portal or whatnot to
39:12
be able to get that access, you know, get that access figured
39:16
out further. Do you with, you know, in those
39:20
scenarios, are you, are you still seeing a situation where
39:24
you want to bring in, you know, where you where you want to
39:28
actually have, you know, where you want to actually have
39:31
somebody build out, you know, you know, basically like
39:35
business owners build out that access or build out, you know,
39:37
build out how that works, I think.
39:39
It's ultimately what it comes down to, right?
39:41
So if you're implementing something like an ERP system
39:46
within your organization, even though the ERP system might be
39:50
able to handle, you know, thousands or hundreds of
39:55
thousands of permutations of what a full set of
40:00
authorizations could be, you can still have the discipline within
40:03
your organization to say we're only going to do these.
40:08
This ten types or these hundred types, which really like these
40:12
are the important fields that we want to drive access based on.
40:15
Now understand I'm that might not be appropriate in all cases
40:22
because I think the biggest thing playing against any kind
40:28
of role model or you know, when you try to make authorization
40:34
simpler and by making it simpler, you're going to say,
40:37
well, you know, 90% of the people that need this access
40:42
need these things, so let's just give it to 100%.
40:47
That is not least privilege. You know, at least it's not a
40:51
black and white view of what least privilege is, because
40:53
black and white view of least privilege is you only get the
40:57
access that you need. So if we're giving you access
40:59
that you don't need because it's more convenient, I'm sorry,
41:04
that's not least privilege. I know that it might be just the
41:08
academic argument, but I mean that's the reality in my
41:14
opinion. Since there isn't going to be
41:16
that you know that that standard for the next, you know that
41:20
won't that won't occur for the next 5-10 fifteen years if we're
41:24
being optimistic. I think that's what's driving me
41:27
to policy because policies more customized policies more a Jason
41:33
statement or an XLML statement of some sort that I can take and
41:36
I can actually put in my if and then's and whiles into the into
41:41
it. I hope that, you know, I hope
41:43
maybe in the future in that, you know, in that standardization
41:46
that you're talking about, we'll actually, you know, we'll take
41:49
that into consideration and use, you know, going to use that as
41:51
kind of the the backbone of it. Gee, gross.
41:54
It looks like you're picking some real easy ones to start off
41:57
with, so I know you had at least three in mind already.
42:04
Sure. So let's take a step back.
42:06
So I know that I, you know, I've, I've, I've hit you with,
42:10
you know, I did, you know, with the non human identities and got
42:12
into the granularity there. I know we've been and then we
42:15
just got done talking about, you know, about policy and our back.
42:19
Why don't we talk about the team for a little bit, you know, you
42:22
know, a little bit at this point, what, you know, going to
42:26
Identiverse and going to different conferences and
42:28
talking, you know, you know, talking to dozens and dozens of
42:32
people at this point and kind of getting into their stories and
42:34
getting into what the, you know, how their I, their IAM teams
42:38
work. What I find most interesting is,
42:41
is how different we really all are.
42:45
We all feel like we're doing the same thing.
42:47
We all feel like we're basically heading in the same direction
42:49
and trying to go after the same things.
42:52
But our, you know, our mode of transportation or our, you know,
42:56
our group that we're using to get there is so vastly
43:00
different. And another article that I'm
43:03
going to be working up is, is going into, you know, kind of
43:06
going into that. There is, you know, there are
43:08
groups, there are, there are businesses out there that of
43:11
course focus on all the different pieces.
43:14
But you know, they, you know, that in the end you have to kind
43:17
of have all the different elements.
43:18
But the question is, is do you have a dedicated team to anyone
43:22
particular area? How how heavyweight or
43:25
lightweight do you go and into, into each one Personally, we're
43:29
a, you know, we're a governance shop.
43:31
We're, you know, we're very much there to help the business and
43:33
they're very much there to enact what, you know, you know, kind
43:38
of, you know, enact whatever, you know, enact whatever
43:40
controls that are around it. That's kind of where our
43:43
heavyweight is. And then we work toward then,
43:46
you know, and then we do, yeah, we help facilitate that through
43:50
taking care of the day-to-day provision.
43:52
But with that, I'm learning, you know, I'm learning that there's
43:56
not just, you know, there are teams out there or there are
43:58
departments out there and other organizations that solely focus
44:02
on governance and then solely focus on provisioning.
44:06
And then I'm finding out about new groups that are being spun
44:09
up, especially with this latest, you know, this latest trip to
44:11
identifiers that are focusing on the cybersecurity side.
44:14
You know, the more cybersecurity focus side of it, being able to
44:18
find fishing, you know, trying to define and trying to build
44:21
out fishing resistant IAM accounts or, you know, identity
44:25
accounts. And then there's the cloud teams
44:28
that are trying to help the dev OPS groups keep their
44:30
infrastructure up and running and keeping this, you know, the
44:33
spin up and spin down and the keys that go along with it up
44:36
and, you know, up and running. These are all things that, you
44:40
know, I'm, I'm at the kind of the beginning of that journey of
44:42
understanding that they're, you know, we don't as an operations
44:47
team, we don't have to do it all.
44:49
We have to do what's most important to our, you know,
44:51
what, what's most important to our individual groups.
44:54
And then, you know, but making sure that each one of those are
44:57
touched in some way, form or fashion by someone within the
45:00
organization. How do you, you know, do we feel
45:05
as though that that's the way you know, you know, I, I'm so
45:09
used to the idea of, you know, everybody kind of just knows
45:11
where they're going. You knows, you know, knows the
45:13
mode that they're running in, sure.
45:15
You know whether or not you want pepperoni on your pizza or
45:18
whether or not you want sausage. You kind of like, you make some,
45:20
you make some little variations, but for the most part, it's
45:23
still pizza in the end. You're using a bad analogy at
45:26
this point, I admit. Especially around lunch.
45:29
Especially around lunch. But a delicious one.
45:33
But is that is there going to be different, is there going to be
45:37
bigger changes than this or is it you know, or do you see this
45:40
being or you see those being still being the core, you know,
45:44
the core pieces of it going forward?
45:46
Is there where? What should I be looking out for
45:50
as far as as an operations manager of IAM?
45:53
Kind of the doers of IAM what what should I be looking out
45:56
for? I think I'll go first.
46:00
So I think you're getting into organizational design, which is
46:06
somewhat or very specific to the organization, which has a lot to
46:10
do with the size of the organization, how geographically
46:17
dispersed whether or not I am is completely essential service or
46:22
if it's more localized to where the people are.
46:27
But I think we can make some general assumptions or talk
46:29
about some general topics there. You know, I think that one thing
46:34
you have to look out for is because especially in this
46:38
identity space, if you design your organization around all
46:41
right, this is the product that we use for governance and start
46:48
just fixating on, OK, the product can solve these
46:51
problems. And now there's another team
46:54
that is really focused on another product that handles
46:59
authentication maybe or another product that handles privileged
47:04
access management. So I think those are the big
47:06
three with it when it comes to internal identity or workforce
47:10
identity. Now the products will shorten it
47:14
to encroach in each other's space.
47:16
And what you you had the potential for is that if you
47:20
take a product view of the world that then you start doing
47:25
things, doing the same services within each other.
47:29
And I think that's a real danger.
47:31
So I think the teams, if you have separate teams supporting
47:34
those that you're doing all site workshops or something, so those
47:39
teams are collaborating on OK, what is our strategy going
47:43
forward for each of these teams to support and where do we know
47:47
where our lines of demarcation are?
47:50
I think that's very important in a very large organization where
47:53
these different domains are being covered by different
47:56
groups. I think what I see more often is
48:00
smaller teams where people are cross trained across the groups
48:05
and they're working within those groups, especially on the not as
48:09
much on the operation side necessarily, even though I do
48:11
see that on the operation side as well, but build side.
48:16
And certainly like the architect level where they're doing the
48:19
the big time planning of how all these tools work together.
48:23
But I think that is very important.
48:25
It's not to get just locked into too focused of a picture.
48:31
Yeah. What do you have, Jeff?
48:33
Yeah. And I agree with you, it's this
48:35
is mostly organizational design. I think this is the classic
48:39
centralized versus decentralized strategy that a lot of
48:42
organizations might be looking at of, well, how do we handle
48:45
our IM functions? Do we try to build a central
48:47
team that kind of does it all and separate that from the
48:50
business? Or do we allow the business to
48:53
administrate their own applications as long as they
48:56
hopefully adhere to whatever standards or policies have been
49:00
set up by a central organization?
49:02
And, and I don't think the answer is, you know, right or
49:04
wrong either way. It really is a very personal
49:06
decision for the organization. A lot of it comes down to the
49:09
people from the organization itself.
49:12
You know, where where do your skill sets lie?
49:15
You know, is Active Directory an IM tool or is that IT
49:17
infrastructure? Most organizations ADS been
49:20
there forever. And so there is like an, you
49:22
know, a general IT or network group that kind of handles the
49:25
Active Directory stuff. And maybe you have a different
49:27
team that does your IGA platform or privilege access or maybe.
49:31
So I think it's an interesting, you know, discussion to have
49:35
because I think this is one of those things where you have, if
49:39
I had to guess, Chris, when you write this, the comments are
49:41
going to kind of fall into two different camps of a more
49:45
centralized approach and a more of a, you know, governance
49:49
decentralized type of approach. And, you know, nobody's going to
49:54
be wrong and nobody's going to be right.
49:55
It's just like, well, here's what works for our organization
49:57
or what hopefully it works for our organization.
49:59
Some organizations that, you know, maybe they could stand to
50:01
be a little more centralized and, you know, or at least put
50:05
out together, you know, put better policies or standards or
50:07
maybe anything. This is where I am.
50:09
Program management becomes so much more important when you're
50:12
dealing with multiple areas of the business that are not
50:15
directly underneath, you know, your control as an identity
50:19
person or even as an IT person. So I think it'll be, I'll be
50:22
curious to see what, what feedback comes through for for,
50:26
for that article. Yeah, I agree with you both as
50:28
you know, not surprising. And let's say, and Jeff, I think
50:32
you, you know, what you said really, you know, rings true to
50:35
me is 'cause you know, Active Directory is an, you know, is an
50:39
IT function. Is, you know, is, is, you know,
50:41
in our cases is an IT, you know, is an IT function.
50:43
But who takes care of the day, you know, the care and feeding
50:46
of, you know, Active Directory. We do, you know, and we're on,
50:49
we're underneath the, you know, we're underneath the security
50:51
side of the, you know, side of the house.
50:54
There's so much it's so, you know, it's so interesting to me.
51:00
And, you know, in the last three years of being in this position
51:03
of, of trying to learn that my, you know, that I have different
51:08
audiences that I have to, you know that, yeah, that we have to
51:11
work together with to be able to get, you know, to get identity
51:15
handled, you know, handled properly.
51:17
There's how do I, you know, how do I talk SL as to the business
51:23
and then talk about, you know, how does single sign on actually
51:27
work in the background to that, you know, to the IT side of the
51:30
house and what you know and what you know and their concerns with
51:33
it. While then keeping a balancing
51:35
act of my, you know, my stakeholders insecurity.
51:39
Asking the question of, well, can we make sure that we know
51:41
that this guy really is in California or is he in New York?
51:45
Let's let you know, let's let's know who were the right answer
51:48
of that. You know, the location of these
51:50
users are, it's a, it's a, It's an interesting, interesting
51:55
challenge. You know, another thing you
51:56
brought up in your question or your topic, Chris, was are some
52:01
of these things going to go away?
52:03
And I don't know if you were hinting at like, OK, AI is going
52:07
to do these things for us. Because I look, if AI does, if
52:12
five years down the road, we're not just allowing business users
52:17
to go into AI and say, I need to rerun a recertificate
52:21
recertification campaign of all of my users who use this
52:26
application. And I want to send that to this
52:30
manager or the person's manager or whatever and basically use
52:33
prompt engineering to construct their own access certification.
52:40
If that's not available in five years, like what is AI really
52:43
done right? I mean, that should definitely
52:45
be available in five years. And I got to think IGA companies
52:50
know that if if they're not doing that, someone's going to
52:53
come along and invent that. So, yeah, I think some of these
52:58
jobs that you know, I remember when I ran the IAM program for a
53:03
bank, we had a person completely dedicated to running access
53:07
certifications and managing access certifications that were
53:11
in flight. Once those were all done,
53:12
generating the reports and getting the next round started
53:16
so that we could attest to access on a quarterly basis,
53:21
those things had better go away, right?
53:23
I still do have that guy, that guy you're talking about who
53:26
does the quarterly certifications that we do
53:29
function as a bank. So therefore, you know, I do
53:32
have that person on my team that that they really do or they do
53:35
run access certifications day in and day out, night in and night
53:38
out trying to trying to help manage, you know, trying to help
53:41
manage that expectation. I've been, you know, we are of
53:45
course, you know, interested in AI and kind of looking into
53:48
what, you know, what AI can do. But as a side note or tangent,
53:52
I've been looking at it as a, really as a, as a big data model
53:56
kind of scenario more than a, you know, more than necessarily
53:59
an AI one. It's how do I take the, yeah,
54:02
you know, how do I take not only my IGA data, but my ServiceNow
54:08
data and my cybersecurity applications data and my, you
54:12
know, and other forms of data? And how do I put those things
54:15
together to, you know, build a bigger picture of what, what's
54:18
out there to be able to answer, you know, to be able to answer
54:21
more concise questions of is that access really being used?
54:25
Does that access? It does, is that access really
54:28
appropriate anymore by by looking at the, the metadata
54:32
around everything around it? It's a it's a great question and
54:36
I would love, I would love an AI to help me do that, but I'm I'm
54:39
not there yet. It's going to get better, right?
54:42
I think AI, this is the worst it's ever going to be.
54:45
It's going to keep getting better from here.
54:47
And it's already pretty darn cool.
54:48
I mean, I'm a I'm a fan of it. And the good news is you picked
54:51
three really easy blog topics to get into.
54:55
So I'm sure it'll be super easy to to come up with different
54:59
viewpoints. And I'm curious to see, you
55:00
know, the comments and the feedback.
55:01
So I'll be looking forward to those.
55:04
You've been very generous with your time and it is a Sunday, so
55:07
why don't you go? You even went in, you even went
55:08
into the office to record this. So you know above and beyond,
55:13
but I have something very important to ask you as a Marvel
55:17
fan or as a Co Marvel fan, what are your thoughts on Robert
55:21
Downey Junior being announced as Doctor Doom coming back to the
55:25
Marvel Universe? So I'm really curious on whether
55:30
or not the mask will actually come off.
55:34
You know that when reading the articles and reading the things
55:37
that they talk about, you know, about Robert Downey Junior doing
55:40
that, you know, being Doctor Doom, I think the actor has the,
55:44
you know, has a great ability to play, you know, to be able to
55:48
play the part. Can he play that villain?
55:50
Can he play that, you know, that kind of empowered just like, you
55:55
know, master of all kind of, you know, kind of character.
55:57
Absolutely. Robert Downey Junior's can knock
56:00
that will knock that out of the park.
56:03
Will they, though, take the mask off?
56:07
Will, you know, will there be scenes in any way, form or
56:10
fashion where we really know it's him underneath it in any
56:14
way, form or fashion? I don't know how they do that.
56:18
I don't know if they had I, you know, I would like to think
56:20
Doctor Doom can't take it off. And therefore it's not a, it's
56:22
not a question. But if there is, you know, are
56:27
we doing a multiverse thing here?
56:29
You know what's the, you know what's the, you know what's the
56:32
play. Well, yeah, I mean, he is Iron
56:35
Man. He told you this, you know,
56:36
point blank to the camera, right?
56:39
And then he snapped his fingers. You know, that's that mean,
56:44
that's a benefit, right? He's used to playing a character
56:46
with a mask, being an Iron Man. Now, obviously, Tony Stark, you
56:49
know, pulls the mask off much more frequently than Doctor
56:52
Doom. And I'm sure they'll take
56:53
liberties because, you know, they have to make a movie kind
56:57
of out of it. But it'll be interesting to see
56:58
how it goes, I think. I think it's interesting to have
57:01
the same actor playing two different roles within the same
57:06
universe. And how do they explain that?
57:09
Is it a multiverse angle? Well, you didn't, you know.
57:14
If you didn't, you know. I don't want to, you know, a
57:16
little bit of a spoiler if you haven't seen the Deadpool
57:18
Wolverine movie yet. I have.
57:20
Not, don't spoil it. All I'll say is is Captain
57:24
America makes a, you know, makes an, you know, makes an
57:26
appearance. And then you'll see something
57:28
else happen there too. That'll be you know that you'll
57:31
that'll come to that same question.
57:33
OK, well, I'm a fan of Deadpool, so I'm looking forward to seeing
57:36
that what I can. Jim, do you have any idea what
57:39
we're talking about? None.
57:41
None whatsoever. Actually, I did know that there
57:44
was a Deadpool movie. And Wolverine.
57:48
Jesse for Ryan Reynolds. Yeah, you're right.
57:51
I know that Ryan Reynolds is the Deadpool, but that's all I know.
57:55
OK, now I'm kind of like anything else they say is
57:58
totally uninformed. So when you hear the the
58:01
character Doctor Doom, what comes to mind just.
58:04
As amazing. So those comic books were around
58:08
when I was a kid. So I'm familiar with Marvel
58:11
comic books. And what I've found is like when
58:14
these movies come out and they had the the surprising things
58:18
nobody was expecting, it was in one of those comic books like
58:23
#138 that I mean, who the heck is going to remember every
58:27
section of a comic book? So I think the creators go back
58:31
into the comic books and one of the things that I, I'm always
58:34
shocked by is like how dark some of those comic books really got
58:38
because I didn't realize it when I was a kid.
58:41
I was collecting them and looking at them, but I wasn't
58:44
looking at them in the way an adult would look at them, right?
58:48
To really understand like the subplots, it's just like you're
58:52
looking at him like kid, like, oh, that guy's cool.
58:54
That guy's a bad guy. I don't like him or whatever.
58:57
So, but I always think it's neat how they tie it back to a real
59:02
comic book. And there was like, Oh yeah, we
59:05
should have known that was coming.
59:06
It's kind of like how Game of Thrones tied back to those books
59:13
and like people who are like, really geeked out on the books.
59:16
What was it like fire and ice or something like that?
59:19
They'd be like, Oh yeah, they kind of knew what was coming,
59:22
etcetera. So it it's similar to that,
59:26
yeah. Well, it'll be interesting to
59:28
see that Doctor Doom. So he's the the main villain
59:31
that's opposite of the Fantastic Four.
59:34
So I know that there's been a Fantastic Four in the past.
59:37
I don't think it was fantastic, but it was it was fine.
59:41
So I know they're kind of rebooting that, but it'll be
59:43
interesting to see how it goes. I just thought it was
59:44
interesting. And you know, if you've seen the
59:46
clips at this point, right, Robert Downey Junior comes on
59:49
the stage, there's a bunch of different Doctor Dooms and he
59:51
pulls off the mask and then you see him.
59:54
And this is how they announced it like Comic Con or something
59:57
like that. So it got it was it was it was
1:00:00
kind of a cool reveal to be I guess maybe if you were in the
1:00:02
room, you're like, you know, holy, you know, whatever.
1:00:06
That's Robert Downey Junior And you know, after him having had
1:00:10
such a successful, you know, journey to the whole Iron Man
1:00:14
kind of process and then to the The Avengers, it's kind of
1:00:18
interesting to see how they. How they tackle that or if they
1:00:21
just ignore it, they got. It's just it's a different.
1:00:23
Role so aren't there like 2 lines of comic books There's
1:00:26
like that and then there's the one where they had like the
1:00:31
what's the the the League of Nations or something and I
1:00:35
remember seeing a commercial now where Aquaman is fighting that
1:00:40
one guy who's got like the the. What are you mixing DC and
1:00:44
Marvel? DC and Marvel, that's what I'm
1:00:46
saying. That's yeah.
1:00:48
I can't keep up with that soft man.
1:00:49
I don't know how you guys do. DC has not had a successful film
1:00:55
background. I would say with the exception
1:00:57
of Batman's movies, they've probably done the best, but they
1:01:00
haven't really been tied to like ADC universe of like Superman,
1:01:04
Wonder Woman, Batman, The Flash, etcetera, those sorts of things.
1:01:08
I think Marvel has definitely done a much better job of
1:01:11
getting their characters out there and, you know, producing
1:01:15
good fun films to see. Wasn't there like a Superman
1:01:18
versus Batman where they were fighting with each other and it
1:01:21
was like, that was pretty dark, wasn't it?
1:01:24
Most of the DC films have been dark.
1:01:25
I don't know Chris about you, but I feel like DC tends to be a
1:01:28
little of a darker approach to their characters compared to
1:01:32
Marvel. Yeah, DC's always been darker
1:01:36
that, you know, Marvel's always been, you know, Marvel's always
1:01:39
been a little bit more upbeat and a little more like there's
1:01:42
a, there's a happy ending to the story kind of thing.
1:01:44
Where in ADC movie, there's no guarantee that the movie doesn't
1:01:47
end with people, with everybody dead.
1:01:49
And, you know, and like you and, you know, and the storm clouds
1:01:52
basically, you know, dissipating around the, you know, around
1:01:55
the, you know, around the world. That's a normal.
1:01:57
That's a normal look. All right, Well we got into it.
1:01:59
I was curious, Chris's to see what you would thought about our
1:02:02
opportunity to coming back, but let's go ahead and leave it
1:02:04
there for this week. Chris, thank you so much for
1:02:07
your time. I'm going to have a link in our
1:02:08
show notes to your LinkedIn article.
1:02:11
Connect with Chris on LinkedIn and you know, maybe provide some
1:02:14
some fodder for articles coming up or opinions and things like
1:02:17
that. Jimmy and I are on LinkedIn, so
1:02:19
definitely connect with us and you know, send us comments,
1:02:22
feedback, etcetera. We're on the web,
1:02:24
idscpodcast.com, Twitter X, whatever it's called at IDSC
1:02:28
podcast. If you're watching this on
1:02:30
YouTube, thank you so much. Hit that like and subscribe
1:02:32
button. That's the best way you can help
1:02:33
us out. If you're not watching us on
1:02:35
YouTube, do us a favor and jump over to YouTube real quick and
1:02:38
and give us a subscription. That would be fantastic to make
1:02:41
it easy. You can hit idacpodcast.tv.
1:02:43
That'll take your right to our channel.
1:02:45
And yeah, we'll go ahead and leave it there.
1:02:47
Thanks everyone for watching and or listening and we'll talk with
1:02:51
you all on the next one. You've been listening to
1:02:56
Identity at the Center. We hope you've enjoyed the show.
1:03:00
Make sure to like, rate and review, and we'll be back soon.
1:03:04
But in the meantime, hit the website at
1:03:06
identity@thecenter.com. See you next time on Identity at
1:03:13
the Center.