Latest / Identity at the Center / #82 - Organizational Change Management with Carlos Rodriguez

Transcript

#82 - Organizational Change Management with Carlos Rodriguez · Identity at the Center

0:09
You're listening to the Identity at the Center podcast.
0:12
This is the show that talks about identity and access
0:14
management and making sure you know who has access to what.
0:18
Let's get started. Welcome to the Identity at the
0:26
Center podcast. I'm Jeff and that's Jim.
0:28
Hey, Jim. Hey, Jeff.
0:29
How's it going? Not so bad yourself.
0:31
Good. I was listening to our show the
0:33
other day for the first time in a while.
0:35
I I mean, I don't listen to every episode, right?
0:37
I'm on every episode. But I don't like to listen to my
0:41
own voice. I think a lot of people have
0:42
that aversion, and I've got to say Jeff.
0:45
And so for everyone who's listening on a regular basis,
0:49
they should know that you are the man behind the scenes who.
0:53
Does all the editing work and everything and all the funky
0:56
music in the beginning. And that's what really got me.
0:59
I was like, whoa, we're like, totally pro here.
1:03
I was wondering if I could notice that I kind of slipped
1:05
that change in earlier this year.
1:07
I figured, yeah, New Year, let's maybe try something look
1:09
different. But yeah, I don't listen to our
1:12
shows, even even when I'm editing them.
1:14
You know, I'm listening to them, but I'm not really listening to
1:16
them. You know, I'm looking for like
1:18
background noise and like clicks and you know, trying to, you
1:22
know make sure that it that it sounds as good as I can in my,
1:25
you know, totally amateur and I'm sure totally unprofessional
1:28
way. I headed the show.
1:30
So it is totally, you know, you know, I've learned a lot over 80
1:35
plus episodes at this point. But yeah, I appreciate that.
1:38
So it's, you know, it's cool. It's it's a it's a passion
1:41
project. I think between the two of us,
1:43
it's kind of started and you know, here we are several months
1:48
and dozens and dozens of episodes later.
1:50
Well, the other day I said to somebody we were on a call
1:53
together and I said, yeah, this is my favorite part of the job.
1:55
And remind me, it's not really part of the job.
1:59
Yeah, it would be cool. Yeah, it's it's definitely, you
2:02
know, we we do have day jobs. We don't really talk about it
2:04
too much, you know, but but yeah, we do.
2:06
You know, I am strategy assessments and things like
2:08
that. But yeah, you know, we don't do
2:11
sponsors either, so it's going to be kind of hard to turn this
2:14
into, you know, a paying gig without sponsorship I guess.
2:18
And and I don't know if that's where we want to go with it.
2:21
So waiting for that call from Spotify, you know that
2:23
$1,000,000 check right? Well I guess if you're
2:25
interested in sponsoring, right you know feel free to get in
2:27
touch if it makes sense as long as we can keep it, you know
2:30
relatively vendor neutral. I'm I'm pretty open to to
2:32
anything at this point. I agree.
2:34
I agree. You know what's really been
2:36
great though has been the feedback from our listeners and
2:40
somebody that. We're having on today is a
2:43
listener of the show and we've been in contact with and he's
2:48
somebody who puts out a lot of content himself.
2:50
So Jeff, I'll pass it back to you to do the introduction.
2:53
But I think it's really cool that, you know, our listeners
2:56
are reaching out and there are people who are active by and
3:00
practitioners as well. Yeah, it is super cool and you
3:03
know, super pumped. Actually have Carlos on the
3:05
show. We'll get to him in a second
3:06
here. He wrote an article that touched
3:10
around, you know, how to build a successful I M program and it
3:13
was on enterprisesecuritymag.com.
3:16
I'll wait to the article in our show so you can kind of check
3:18
that out. And part of that article touched
3:21
on managing organizational change, which I thought was
3:23
interesting and it's something that sometimes gets overlooked
3:27
right when we're developing programs and kind of getting
3:29
things out, out and then the into the real world.
3:32
So without further ado, why don't we bring on the author of
3:36
that article? His name is Carlos Rodriguez.
3:38
He's the director of IT security and Risk at Citizens Property
3:42
Insurance. Welcome, Carlos.
3:44
Thank you, Jim and Jeff, happy to be here and I and I will
3:48
start with not only thanking you for my the opportunity but for
3:52
the content that you put out every day or every week.
3:56
Been listening for about a year. So I.
4:00
I appreciate it on behalf of the of our community.
4:03
Oh, well, well, thank you so much.
4:04
Hey, I feel like this deserves like a, you know, longtime
4:07
listener, first time caller radio tropes.
4:11
But yeah, no, that's really cool and excited to have you here
4:14
because I really want to get into that, that whole topic of
4:18
the change management. But if you've been listening
4:21
right, you probably know the first question, which is, you
4:23
know, how did you get into the I Am space of the Infosec area?
4:27
Is it something that shows you it or did you choose it?
4:30
I think we chose each other. Honestly.
4:33
I grew up on the help desk rank like many and you know part of
4:38
that usually involve provisioning and deprovisioning
4:41
user you know from a execution point of view and building a few
4:47
processes. But from there I got engaged
4:51
with third party access or remote access from a security
4:56
point of view, from firewalls and what have you.
4:59
Concentrators then kept growing into more of leadership roles,
5:05
driving strategies for access as a whole in different
5:11
organizations, My passions always being insecurity, and I
5:16
discovered a few years ago that access was key to have sound
5:22
security for any organization. So Carlos, we we've referenced
5:26
this blog already. And the the focus on it was
5:31
organizational or managing organizational change, right.
5:34
It's such a big part of anytime you roll out I M technology
5:39
projects, new processes, you know the the amount of impact
5:45
they have on people and managing that impact is really key to the
5:51
success of your of your initiative.
5:53
So tell us about the blog. Tell us about what your
5:55
perspective is on change management.
5:57
Sure. So, yeah, so identity and access
6:01
management is a broad topic. It's a program, it's not a one
6:07
off. We're gonna put MFA here and be
6:10
done or single sign on it. It's it's a big business
6:15
initiative and that's how I approach it.
6:19
And because of who we are, we needed to have a stakeholder
6:25
support. All the way to the Board of
6:28
Governors of citizens and we all you also have to realize and and
6:34
I'm sure you all understand this, but you are changing the
6:38
way people work and interact with data and systems.
6:41
So usually it's very disruptive, right.
6:44
And that's where organizational change management can help you
6:50
to to navigate the long journey. Because that's the other point,
6:54
this is, this is a long journey. You're probably working on this
6:57
piece this year, but next year you're gonna jump, going to jump
7:00
on a different project and so on, and they all tie it into
7:05
each other. So there are different
7:08
techniques for organizational change management that can help
7:11
you navigate the journey and get the support from the
7:15
stakeholders. You know, I I've always kind of
7:18
felt that I am. It may be only second to an ERP
7:22
initiative in terms of. How much it impacts and how much
7:26
it touches the business, but in a way, in a way I I prioritize I
7:32
M because it's usually the 1st place that people have an impact
7:37
with the organization. So if you are a customer, it's
7:40
obvious, right, there's that whole registration and getting
7:43
logged in and things like that. But even on the enterprise side,
7:47
your first activity usually onboarding to the organization.
7:50
Can you access? All these systems and even more
7:54
so with everybody working remotely now.
7:56
But it's just that level of touch, right?
7:58
It's such an impact on everybody and it's that first impact that
8:04
they feel. That is correct.
8:06
And then you have you you talk about on board and then you have
8:09
to take those accounts down at some point in time or change you
8:13
know their access as people move through their through their
8:16
organization. So it's it is an ongoing
8:19
process. From, you know, the first day,
8:22
your first day to your last day, we got to manage these
8:26
identities when you're managing change for the organization,
8:30
right? No matter what it is, I would
8:31
imagine that this is not a one and done type of situation,
8:34
right? It's something that's going to
8:36
evolve and you're going to identify areas that you want to
8:39
improve on just like anything else, right?
8:40
Things that maybe got missed the first pass.
8:42
OK, let's remember that for next time.
8:44
How do you approach that type of situation where you know,
8:49
getting it stood up and then getting it ready to go?
8:51
Sure. So what we did was we we brought
8:55
in stakeholders from the entire organization, from all business
9:00
units and and basically interview them what are your
9:02
strong points, where are your pain points and based on that we
9:08
built a holistic strategy that then we presented to them and.
9:17
For feedback, you know part of the idea outside of the house,
9:20
but you know there are different techniques for getting started.
9:26
I was blessed to have an internal organizational change
9:31
management team and one of the as soon as they started and
9:36
found that out, I went to them said OK, this is a multiyear,
9:42
very impactful initiative. And you helped me and they
9:47
brought in some techniques and presented to to me and what they
9:52
they usually lead with. And the preferred technique here
9:56
for us is is known as at CAR. That's a DKIKAR and it stands
10:05
for the awareness, desire, knowledge, ability and
10:11
reinforcement. What does that mean?
10:14
Well, first you have to be aware that a change is needed.
10:17
That's your awareness, right? And that's where communication
10:20
starts to drive that desire for that change.
10:25
And and that's the most difficult part, right?
10:27
You're changing someone's way of working and that that has an
10:33
impact. Then you focus on that
10:35
knowledge, you know, training, how is the change gonna gonna
10:39
impact me and what have you? Again, the training list to
10:43
acquire and the abilities that you had that you need to have to
10:46
support and sustain the change and then the reinforcement is
10:51
ongoing. You probably have heard a lot
10:54
that we seen a lot of technology projects everywhere that but we
10:59
never capitalize on the promised land, right, because there is
11:03
another priority or or whatever reason.
11:06
Sometimes we don't finish our projects and that's a
11:09
reinforcement piece and also measurement of it of of the.
11:13
Change, so it sounds like your organization takes change
11:17
management very seriously. You talked a little bit about
11:21
you had these internal stakeholders that you worked
11:24
with. Talk to us a little bit more
11:25
about that. Was that like a, I mean I'm not
11:28
sure if it your organization that's kind of formally
11:30
established or? You kind of reached into the
11:33
organization to find people. I would think that it's kind of
11:36
more common that you're really gonna need to identify who are
11:40
the people that can assist you in this area.
11:42
But maybe talk a little bit about what your approach was in
11:46
terms of identifying the people that could help you.
11:49
This sounds I I would imagine as a new person in your
11:52
organization where you need some kind of mentoring of houses done
11:55
successfully in the past, but then also you have to have
11:58
people who have. Influence within the
12:00
organization and the groups that you're trying to reach out to.
12:04
Correct. So you touch on a few items that
12:07
I did go by. One I look for look up to my
12:12
sponsors, right? Who were the sponsors of the
12:15
project, in this case, the two Vps in it.
12:19
One is my boss who handles a strategy, architectural
12:23
resiliency and security. The other one was the technology
12:27
VP. And within those groups and the
12:31
first thing was understand, OK, what is the business process
12:35
here? Let me follow the money if you
12:38
would, right. That's what this is always go by
12:41
what are the key processes in the organization.
12:43
I partnered closely with our our enterprise architecture team who
12:49
is a a sister organization and the resiliency team also a
12:54
sister organization. We're all on the same
12:57
leadership. On the resiliency side, that was
13:00
key because they had conducted business impact analysis
13:03
already. So I just went there, look at
13:05
it, OK. And then from there I went to
13:09
the process owners of those critical processes.
13:14
We just as a little bit of background because I didn't
13:19
mention this earlier, Citizens is the insurance provider of
13:24
last resort in the state of Florida.
13:27
That means we provide. Coverage for those who cannot
13:30
get it in a commercial from a commercial carrier, well, that
13:36
means that a big part of our mission as a company and one of
13:40
our bodies is that of service. We have to be there for the
13:45
policyholders when a storm hits. We actually have to be on Ground
13:49
Zero 48 hours after that of the events, so.
13:56
One of the key processes for us is boarding the independent
14:00
adjusters that go assess the damage of the storms, right.
14:05
And and that's one team I went to.
14:08
We also have, we don't have a sales force internally pretty
14:11
much we, we work a lot of with brokers and agents, right.
14:15
That's another key stakeholders, then we have policyholders and
14:18
then our internal users. So though, through all of these
14:23
business impact analysis and my partnership with Enterprise
14:26
Architecture, identify those key stakeholders and then brought
14:30
them in for the conversations. What happens if you're talking
14:33
with the stakeholders and you get a real stick in the mud,
14:36
someone who might be difficult, Have you encountered that And if
14:40
so, you know is that something you know?
14:42
What are some of the the tips or tricks you might have for the
14:44
folks who are listening? When, when that will happen, not
14:47
if when. Right.
14:49
So, well, first, understand that change is a long process, right?
14:55
Studies have shown that organizational change really
15:00
sticks after three years, leave or take.
15:05
So there is a concept known as a change change curve, which
15:12
visualize how this process goes, right.
15:14
So you are a status quo for a while, right?
15:17
Everything is going. It's going well, and then
15:20
there's change. Reintroduce the change.
15:22
Right at that point in time, what happens is exactly what you
15:27
described, yet is denial. Why are you doing this to me?
15:32
In fact, why is I also usually people also take a self denial
15:40
type of the. Why am I?
15:42
Not taking on this and that type of deal.
15:44
So then you that that sort of was start going down right on
15:49
the curve. Then there is a little bit of a
15:51
valley at the bottom and that is when there's doubt and confusion
15:57
and you know uncertainty and that's where I'm looking for
16:03
what's in it. For me, that's a big piece of
16:06
the change. Processes.
16:09
We're all looking on what's in it for me, and that's me as a
16:12
leader. That's what I need to
16:13
communicate because what you want to do is on that valley,
16:18
you want to get out of that valley as soon as possible.
16:21
You don't want to stay there alone.
16:23
And one of the books of my favorite books is called Pixon
16:28
Valley. Actually, there's a key question
16:31
that they ask there in this situation, which is what's the
16:36
truth in this situation? And so I help people understand
16:40
that if as much as you can, I partner with at that point with
16:44
my sponsors and other people that had more time in the
16:48
organization to understand the other side because you know, I
16:50
was dealing with people I didn't know for the most part.
16:53
So before each conversation I would prepare to with with
16:57
longer tenure people in the team.
16:59
To understand, OK, I'm going to have the conversation with this
17:02
stakeholder, Tammy, who is what's what's going on with this
17:05
person? What is he looking for?
17:07
She's looking for. So then once you start coming
17:12
out of the valley, you go start going up to rationalize to
17:16
actually accept the change, and then you get to the
17:20
reinforcement part of it. So in short, I think.
17:26
I wanted to explain that that process, but really you have to
17:30
communicate what's in it for, for the person or for the
17:34
business unit. Help them understand that and
17:38
and part of what I do also is help them understand, uncover
17:42
and manage risk so they can make better decisions.
17:46
Usually that works well. You mentioned the, you know,
17:49
establish you know, using established relationships.
17:52
And I'm and I'm curious your thought on this is you know I've
17:55
been involved in organizations where I've you know been there
17:58
for a while and okay, let's start an I M program And I've
18:01
also worked with organizations where it didn't exist and I was
18:04
brought in to create that I M program and didn't have the
18:08
luxury of knowing anybody really, right.
18:11
I'm this this new person coming into the Oregon you don't have
18:14
to stand up and I an effective I M program without the benefit of
18:19
any relationships. I see good and bad in that
18:22
because you're also not carrying baggage potentially from you
18:26
know previous previous projects or previous you know
18:28
expectations those sorts of things.
18:30
What are is your thought around you know you would you think one
18:34
is easier than the other. Are they about the same?
18:37
You know, what would you do if you were kind of dropped into
18:39
and you had a choice? Would you go into a new org or
18:42
would you try to start it up, you know, with the current org?
18:44
Well the the way I would approach that is you you are
18:49
working with someone internally. Right.
18:51
I mean, you are a consultant coming in, in your case and
18:54
you're working with someone in the team, in the internal
18:57
organization. That will be me.
19:00
My role, my responsibility is to present those people to you so
19:07
you can have those conversations.
19:09
And that's what we did, that we work with a with a third party.
19:12
Consultant here. And that was my role.
19:15
I was the coach at quarterback. You know, let's bring claims,
19:18
let's bring vendor management, let's bring legal and I will
19:22
brief the team, the consulting team.
19:25
We're bringing these folks. We will give them a little bit
19:28
of background and then we really let the business guide the
19:32
conversation. Tell me about your process.
19:34
What matters to you? Let because at the end of the
19:38
day as I mentioned earlier, this is a business initiative, this
19:42
is not a technology project and that's how we gain support from
19:45
the board and everyone. And so you make them feel like
19:49
we're listening to them, right. And you know all the techniques
19:54
around listening and reinforcement.
19:56
And then when you present the results back, make sure they get
20:00
feedback again. Go through another iteration and
20:03
usually, you know, they felt they were part of it.
20:06
This is not it or Security working on Asylum telling us
20:10
what to do. They actually are considering my
20:13
input, and there's there's a lot of value to that.
20:17
That's right. So Jeff, I've got a new analogy
20:19
the Carlos just gave me, which is that what makes a good IM
20:22
program manager? Is he or she is a quarterback?
20:26
Right. They just, they make everybody
20:28
else look like bizarre. But Carlos says you're kind of
20:31
going through the peaks and valleys of change management.
20:36
It couldn't help but draw the analogy to the seven steps of
20:42
grief. Yeah, very, very common.
20:44
Very. Nile, you know, and now this
20:46
can't. Be happening to me, but you know
20:48
what it was coming to mind as you're talking about that is,
20:51
you know. You're helping people accept
20:54
this change. Talk a little bit earlier about
20:57
the the trainings that you're you're that you wind up doing
21:02
and things like that. And I think that you know what
21:06
came to mind or what I was wondering was, you know, what
21:09
are like the forms of communication?
21:11
How are you getting this out there?
21:13
Are you, you know, leveraging corporate e-mail newsletters?
21:18
Are you sending? Letter from the desk of the CEO.
21:21
What were some of the the techniques that you used to kind
21:24
of communicate change to the organization?
21:27
Yes, all of them. I mean, so we have different
21:32
ways to communicate because people are busy.
21:34
So you know, we we gotta put the information out as much as we
21:39
can. Obviously there are certain very
21:42
formal channels to communicate with the board and the executive
21:47
team. We use those forms for that
21:50
Ioffer and it was accepted to the executive team to come talk
21:55
to their leadership teams and and remember boards executive,
22:00
these are 10 minutes conversation, right, 15 minutes,
22:03
very shorter to the point and what's in it for me.
22:07
So when I went to talk to claims, I modify my message to
22:12
talk about the claims process and that how this impacts that.
22:16
When I went to talk to HRI talk about you know I GA and how the,
22:22
you know HR system plays into provision and the provisioning
22:27
potentially right, because I knew that was a change that will
22:30
impact them and so on and so forth.
22:33
That's at the business and high stakeholders level.
22:39
Then we also wrote internal articles that came from our CEO,
22:46
who is my line of my line of leadership.
22:50
She is our my boss's boss. So she put articles out there.
22:55
My boss put articles, my other part of my team put articles.
22:58
We also did. And then you, you continue to
23:02
adjust based on the project you're working on, right?
23:05
So MFA we, when we roll MFA out, we put a lot of a series that we
23:12
we call tech talks. It's an open mic conference call
23:16
and with the technology people in there to answer questions
23:21
really brief 10 minutes overview and then it's a Q&A.
23:27
And those were a hit with the organization.
23:30
We had somewhere between 5:00 and 10:00 with maybe 60 people
23:35
average attending, that's that. We also have another venue which
23:42
is our agile. All of our agile ceremonies, one
23:49
of them for example is inspect and adapt.
23:52
Well, that's when we go and show people what we're doing and they
23:56
give us feedback because it's all about feedback.
23:59
That's what we try to to do. We collaborate a lot, we provide
24:04
information, get feedback, make adjustments.
24:07
So a lot of different ways to communicate, but it's about
24:11
reinforcing the the message. Well, I'm glad that you gave me
24:14
that transition, right? We have enough time to kind of
24:17
pick on another topic. And so in another one of your
24:21
blog articles, you talked about Agile methodologies in IM
24:25
deployments. My question bluntly is do you
24:28
find that Agile works better than traditional waterfall
24:32
approaches when it comes to IM? I think it's really.
24:37
I don't know. I know this is not the the
24:40
answer that we all like, but it depends on who you are.
24:42
It depends on your organization. For us, we are still growing
24:48
into the agile transformation. We've been on the journey for
24:51
about 3 to 4 years, which sounds like a long time, but for a
24:56
transformation of that magnitude is actually early.
25:00
So for us we approach it with an agile mentality, but sometimes
25:09
we may apply waterfall techniques depending on the
25:12
magnitude of the of the project. For example privilege access.
25:17
We did a lot of waterfall there early on as we transition to the
25:23
being deployed and and then I gel after that.
25:28
But for most, for the most part, we work in the sprints. 2 weeks
25:33
of sprints where we try to release some sort of value for
25:37
the organization, but you know, while you get the the
25:40
infrastructure in place, it's more of a waterfall.
25:45
But so it's kind of a scrum fall for us, in some cases a scrum.
25:49
Fall I like that, but it sounds like there really is a place
25:51
for, you know, a hybrid approach where you're not strictly agile,
25:56
you're not strictly waterfall, but you take the right approach
25:59
for whatever project or maybe even team right that, that
26:03
you're engaging with. Have you found any particular,
26:06
you know, mix that works really well or is it truly, you know,
26:11
figuring it out as you're kind of going through it with with
26:14
different personalities? You know, it could be a project
26:16
personality or it could be, you know, a team personality.
26:18
That sort of sort of approach. There's a misconception or
26:21
misunderstanding about agile and that I found that with my team,
26:26
just it's deploy fast. Well, it's not that really.
26:30
It really has nothing to do or little to do with the speed.
26:34
It has more to do really with delivering value.
26:38
So with that said, our approach is in our security team and and
26:44
many of the IT organizations here, it's about releasing and
26:50
getting feedback, right. Was this what you were looking
26:53
for? Is this what you're looking for?
26:56
So it's a constant engagement with the stakeholders, with the
26:59
product owners to make sure that we're delivering the value they
27:02
are looking for and because because the other thing is
27:06
there's a lot of competing priorities in any organization
27:11
as you know. And so you gotta make sure that
27:14
you are delivering value. If not, you know they're either
27:17
going to not care much about what you're doing or shut down
27:20
the project. So feedback is the key for that.
27:25
We we do we lean more towards agile to two weeks of Sprint in
27:32
our case. How do you defend the quality
27:35
when it comes to moving with speed?
27:38
Because they think that's typically one of the areas that
27:41
a lot of organizations and, you know, project team struggle with
27:44
is when you get into these heads down sprints and you're kind of
27:47
running full speed. How do you make sure you don't
27:49
you know run through a wall instead of maybe you know making
27:53
sure that you ran through the door that was already there and
27:55
you're not causing more havoc than than you're creating you
27:58
know solutions to We from a script point of view what we do
28:02
is we we try to provide the requirements as early on the
28:07
Canban portfolio, Canban as possible.
28:11
There are different stages. So once what project is about to
28:17
take off, we have a pretty solid SDLC checklist and that's where
28:23
we inject our our IT security assessment tools that lists.
28:32
So it does a a lean risk analysis with what we know at
28:36
that time, right. And it gives you an inherent
28:38
risk that drives your controls and we look at OK, well based on
28:42
what you're telling me we need these controls and that give you
28:45
a a residual risk. So that was very well accepted
28:50
was another change that was like why are you doing this to me?
28:54
Why do I have to now go through these things.
28:57
But once people saw the value that we basically are not even
29:02
in the conversations sometimes because now what we're doing is
29:08
the enterprise architecture team is running with that tool and in
29:12
the future we envision we're kicking off our security
29:15
champions program here very soon.
29:18
We we we did last year but the world changed last year.
29:21
So we had to talk about, yeah, we have to people then focus on
29:25
other things. So we're about to resume that
29:28
and hopefully our security champions can take ownership of
29:31
that. And the advantage is that they
29:32
are part of the business units and you know we'll be more of
29:37
security coaches and they love that we basically provide the
29:42
guidance, vision, requirements and get out of the way.
29:45
That's actually what the followup question I was thinking
29:48
of is, you know, does this kind of.
29:52
Change the role of the Seeso in project delivery, especially
29:58
when it comes to security projects.
30:00
I hear you're saying yes. I don't know if you're saying
30:03
that because that's kind of the Changing minds mindset that you
30:07
have in terms of what that role ought to be or if it has
30:10
anything to do with the agile versus the waterfall.
30:13
What do what do you think of that?
30:14
I think the main role of the SEESO in any organization is to
30:19
build and manage relationships and then provide a vision,
30:25
provide guidance on risk management and so.
30:29
So our mission statement, I'm going to paraphrase it because
30:32
we just redid it, but it's basically we're here to provide
30:38
data and educate the business on risk so.
30:43
So they make decisions where security doesn't matter on risk.
30:48
We manage it for the organization.
30:50
We tell them here's the risk here alternative to handling.
30:55
And then usually from an IT point of view, especially in
30:58
other business units, they come to us say, OK, how can we
31:01
remediate this? Is it possible to remediate and
31:03
sometimes it isn't. That's one thing.
31:06
The other thing that I tried to do is promote experimentation
31:11
because that's part of a, yeah, that's part of who we are.
31:14
And you know, I had a conversation this morning, hey,
31:16
where why are we changing this, the initial guidance that we
31:22
provided to the team. This was a conversation amongst
31:26
the product owners for I am or project owners.
31:29
I'm like, well, we're not saying we're changing direction.
31:34
Let me ask you this, should we listen to what they have to say
31:37
to see if there is any value and we should pursue that route?
31:41
And the answer was yes, we should listen to them like,
31:43
well, let's do that, run a small experiment if it makes sense, we
31:48
keep going. If not, we just say no And some
31:53
people would say, well, you're wasting time.
31:55
But really what we're doing is we're learning.
31:58
So that's the role of the system to me is to manage relationship
32:03
and courage, innovation and and and experimentation.
32:07
Obviously managed help the team manage risk.
32:10
Reminds me a lot of a piece of relationship advice that I once
32:13
heard, and I wish I knew who it was so I could probably give
32:15
them credit. But.
32:17
You know, it's it's, it's not me versus you, it's us against the
32:21
problem, right. And if you can bring in, you
32:24
know, other parts of the organization and and have them
32:26
have a seat at the table and say okay, well, here's here's what
32:28
we're trying to solve for, right?
32:30
Here's what we think. What do you think?
32:32
Usually, you know, multiple heads are better than one when
32:35
it comes to that sort of situation and and empowering the
32:38
organization to make those decisions and those changes and
32:41
to own things I think is a very important part of that too.
32:43
So I I totally agree with that. What are some of the, you know,
32:48
we're starting to come towards the the end of our time here,
32:50
but I wanted to understand, you know, from your perspective,
32:54
what are some of the things that that you use to stay sharp,
32:57
right? I mean, we've been in the space
32:59
for a while and sometimes there are multiple outlets of
33:02
information, especially, you know, in the age that we live in
33:05
with, you know, the Internet, it's no longer the, you know,
33:09
the security magazine that gets delivered to the office so much,
33:12
you know, every week, it seems. What are some of the things that
33:15
that you use to try to not only stay sharp, but to really kind
33:19
of understand the perspectives of some of the stakeholders
33:22
maybe that you're talking with? Yeah.
33:24
Well, listening to podcasts like this is one, this one in
33:28
particular for anything. Identity, I stay up, stay up
33:32
with, keep up with. Then you know I have a number of
33:37
podcasts that I listen to from not only on security but
33:41
leadership. I recently started listening to
33:45
couple on entrepreneurship because that is that helps me a
33:49
lot to you know jump into these endeavors.
33:53
But you know, books I, I really enjoyed the books from Marion
34:00
Hofner on identity attack vectors, privilege attack
34:05
vectors, Those are really great books on this area.
34:10
Books on leadership also besides conference, I am a big fan of
34:18
those. It's very relaxed practitioners.
34:23
I favor those now more than the big, big, big ones where you
34:27
don't really get to talk to peers.
34:29
And that's the last one. It's it's peers, people like you
34:32
that I can have a conversation with about anything.
34:37
Because at the end of the day we someone has seen the issues that
34:42
I have seen and the last thing I do and the hell has helped me
34:46
develop a lot is I actually stay up with what my boss and his
34:53
boss are reading. And I've been doing this even
34:55
before I go to citizens for a while when I went into meetings
34:59
in their offices. You know, president, CEO, CEO,
35:04
CIO, any chief, oh, look at their shelves and just speak on
35:08
it and see what they have been reading.
35:11
And I went and got that book and because that helps me understand
35:15
where they're coming from, what they're thinking about, it's
35:18
been very helpful to me. I think that's a really great
35:20
tip for folks that are out there is to be able to understand the
35:23
perspective that you know, the folks who are in positions you
35:27
know above from a leadership perspective is to understand
35:30
what is their point of view because I think it's an
35:33
opportunity to. You know, reinforce what they're
35:36
hearing or counter what they might be hearing from an
35:39
information standpoint, especially, you know, if there's
35:42
something that maybe is counter to what you're trying to get
35:45
done. So, you know, I, I picture this
35:47
back in the old days, right? Is is, you know, sneaking to an
35:50
office and like peering through books and magazines on the desk
35:53
and things like that to try and get, you know, intelligence on
35:57
on what people are looking at so you can kind of better
35:59
understand the psychology of of why they, why they are the way
36:03
they are. Right.
36:06
Well, that's very cool. We're going to have links to the
36:09
different articles that you've published out there on our show
36:12
notes before we get things wrapped up for this show.
36:17
Any final words of wisdom Carlos, that you can kind of
36:20
throw up there into I am land for the people who are
36:23
listening? Well, from an extra point of
36:26
view, when you if you are building the strategy or
36:28
reshaping it or what have you, remember it's a business
36:33
initiative, it's a business problem and in order to solve it
36:38
you need the business stakeholders to help you.
36:42
Let them guide that strategy and you will get support.
36:46
I've been since I've been here because I took that approach.
36:50
I have yet to find push back from the business.
36:53
Like that. How about Jim yourself?
36:55
Anything you want to close out with before we let these fine
36:58
folks go? I'm just so appreciative of
37:01
Carlos being on the show and sharing his wisdom and his
37:04
experience. It kind of reinforces to me that
37:10
we do have a listener base out there and that the folks who are
37:13
listening are like us, right? Constantly thinking about how
37:19
to. You know, make the business more
37:22
secure, how to make the user experience better.
37:24
And you know, per the topic we discussed today, how to make it
37:29
so that you know the change that we're inflicting on the
37:32
organization is accepted as well as possible right there.
37:37
These are hard things. Change is hard.
37:39
Change is hard to implement, Change is hard to be on the
37:42
receiving end of. But it's just, you know, having
37:46
Carlos on today reminds me that, you know, our listener based out
37:49
there is so strong. And really love interacting with
37:55
all of you who listen on a regular basis and please reach
37:59
out and connect to Jeff and I on LinkedIn.
38:02
And I'm sure Carlos is open to us as well as very prolific in
38:05
terms of publishing articles and and sharing information on his
38:10
feed. So please feel completely
38:15
welcome to reach out and connect to all three of.
38:18
Yeah, that's a good point. You know, I do, I do think the
38:20
the I M field is very welcoming, is is not a very competitive
38:24
field, at least I feel in if you're in the trenches, right.
38:28
We're all trying to solve similar problems, maybe not
38:31
exactly the same, but there are, you know, communities of people
38:35
out there that are struggling with the same problems that you
38:37
might be facing on a daily basis.
38:39
And you know, if it's been solved elsewhere, there is no
38:42
shame in taking what's been learned and applying that to the
38:46
problems that that you've already seen.
38:47
You may have to tweak it, massage it, whatever it may be
38:49
but I think that's a great thing and and one of the things I like
38:52
most about the I AM, you know industry itself is, is everyone
38:56
is very welcoming and yeah totally echo what Jim said about
38:59
connecting with with any of us. I we're always happy to have a
39:02
conversation and and this podcast is proof, right.
39:05
So you know let's let's you know keep the conversation going.
39:08
You know, if there is, you know things that you want to talk
39:10
about, reach out. Let's get it on the table and
39:14
and have that discussion so. Totally appreciate, Carlos.
39:17
Thank you so much. Not only for listening, but for
39:19
being part of the show as well and bringing your, your
39:23
experience, your knowledge to the table for for folks to drive
39:26
benefit from. With that, we're going to go
39:28
ahead and call it for this week. You can hit us on the web at
39:31
identity@thecenter.com. We're on Twitter at IDAC
39:35
Podcast. There's going to be show notes
39:37
that have the links to both of Carlos's writings.
39:41
And links also should connect to any any three of us from
39:45
LinkedIn as well. So with that, we'll go ahead and
39:48
close it out for this week. And thanks everyone for
39:50
listening and we'll talk with you all in the next one.
39:58
Thanks for listening to the Identity at the Center podcast.
40:01
If you like what you heard, don't forget to subscribe and
40:03
visit us on the web at identity@thecenter.com.