Latest / Identity at the Center / #305 - Identity Week America with Ryan Galluzzo of NIST

Transcript

#305 - Identity Week America with Ryan Galluzzo of NIST · Identity at the Center

0:00
So of the 3876 comments. Roughly.
0:04
Roughly aren't were they mostly constructive or what's your
0:07
process to consume and reflect those?
0:11
I love that question. Like what's a high quality
0:13
comment? What's a low quality?
0:15
Comment Yeah, you got to. Think honestly, like, I mean,
0:19
we, I don't think we got one that said we stink.
0:21
But yeah, we, most of them are, are very high quality and
0:24
constructive. Like, I think people who send
0:26
comments understand our process, understands that we take all
0:31
these things into account, like, and so I, I think it's, they
0:35
submit comments because it's important to them and they're
0:37
not going to submit comments that basically just say, hey,
0:39
look, we don't like any of this because that's not constructive.
0:42
That's a waste of their time and it's a waste of our time.
0:44
You don't see a lot of trolling in the comments.
0:46
There's sometimes a little bit of trolling, but it's more of
0:49
like in the tone of the comments.
0:50
Normally what's being said in the comment is still very
0:53
constructive and helpful, but I would say the almost all of them
0:57
are are are are like technically constructive and helpful and
1:00
sometimes tone changes. But but at the end of the day,
1:02
like almost all of them are helpful.
1:10
This is identity at the center. If it has anything to do with
1:15
IAM. This is the go to podcast now
1:19
your hosts Jim. McDonald and Jeff Stedman.
1:29
Welcome to the Identity of the Center podcast.
1:31
I'm Jeff, and that's Jim. Hey, Jim.
1:33
Hey, Jeff, how are you? Not to matter yourself.
1:35
Doing great, man. We're at this Identity Week
1:38
America conference in Washington, DC.
1:41
It's been really good. I mean, I've.
1:43
Met a few people, had some really good hallway
1:46
conversations, and I think the content overall has been a
1:50
little bit different than my day today.
1:52
We've talked a lot of self sovereign identity, a lot of
1:57
identity verification, so exciting stuff.
2:01
I mean, we talk about that within the realm of identity all
2:03
the time, but it's real focused. Yeah, it's been a good
2:07
conference. We're in DC.
2:09
So far, the worst thing that has happened is that we tried to go
2:12
for chicken and waffles last night, as I have been planning
2:14
all day at Yardbird. And of course we're next to a
2:17
Convention Center, so somebody had bought out the place.
2:20
Actually, a couple of people had bought out the place.
2:22
There was like two different things and I was absolutely
2:24
crushed last night about 7:00 PM when I had been thinking about
2:28
chicken and waffles all day and it didn't happen.
2:30
So guess what's happening tonight?
2:32
Chicken waffles. As long as there, as long as
2:34
there's no like buying out of yard burger.
2:37
Yeah, if if that happens, I'll be very disappointed.
2:40
Yeah. So I died a week.
2:42
We're the one in America. So thanks to those who have
2:45
helped get us here, companies like RSM who sponsor us to get
2:48
out here and bring this kind of content to you.
2:51
Definitely the Identity Week folks for helping us, you know,
2:54
get set up here with a space to record and inviting us in.
2:58
I did a panel yesterday on the future of, or actually was
3:01
navigating the future of identity access management.
3:03
So we had people from Adobe, Swiss Bits, Northwestern Mutual,
3:09
TD Bank had a really kind of cool panel kind of pontificating
3:13
on the future. Yeah, I know you were in the
3:15
audience. I was in the audience.
3:18
That was, that was. Deep cut that was like specific
3:24
episode. Season 4, episode number 2.
3:29
Even the episode name. Even the episode.
3:31
Name. Yeah.
3:32
My new friend Ben. I loved it.
3:33
I thought it was awesome. And it was, it was a lot of good
3:35
times. So it's been good.
3:37
I think, you know, been able to get out here, see people and
3:40
make connections and do all that kind of stuff.
3:43
So and you've become quite the MC.
3:45
I don't know. I think I'm still figuring it
3:49
out as we go on. Every time is a new time.
3:52
I've done a handful now, so I'm starting to kind of figure
3:54
things out. But yeah, I seem to, I seem to
3:57
be the MC type of role quite a bit, which is fine with me.
4:00
I think it's easy 'cause it's not like I'm on the spotlight or
4:03
I haven't. If there's anything, it's like,
4:04
hey, and here's Jim, he's the really smart one.
4:06
Yeah, yeah, just like you're on your podcast.
4:10
Sure. So again, shout out to RSM.
4:15
Yeah, thanks for that. If you're going to Identity Week
4:18
Asia, that is still coming up, I think in October in Singapore,
4:22
Ida C30, you get a discount for that.
4:25
And so thanks for showing, showing support for the show for
4:27
that. And yeah, why don't we get to it
4:29
today because we've got a guest. He's actually been on the show
4:32
before. He is Ryan Galuzzo.
4:34
He's the identity management program lead at NIST.
4:37
Welcome back to the show, Ryan. Thanks for having me again.
4:40
I'm excited to be here. Well, thanks for taking the
4:42
time. I know you spoke yesterday and
4:44
we're going to get into this little bit, but you were with us
4:47
about 50 ish episodes ago, 256 and so I'm not going to make you
4:52
rehash. Sorry for identity origin story,
4:54
but what's new? What's been happening in the
4:56
last? What's new and what's been
4:58
happening? So I have to be honest, I'm
5:00
terrified to listen to my own voice.
5:02
So I didn't actually listen to the episode.
5:03
So I don't know if I can remember everything that we
5:05
talked about. But you know the big things that
5:08
I would say, the two big things that we've kind of subsequently
5:11
announced since then and actually just past couple weeks.
5:15
One, we have a mobile driver's license project that's going on
5:19
within the National Cybersecurity Center of
5:21
Excellence. I don't remember if we talked
5:23
about this previously, but basically the NCCOE is a place
5:26
where we bring COTS product providers, technology providers,
5:32
government partners, industry partners together to actually do
5:36
real builds that are based on international and, and, and this
5:40
standard. So essentially we've we've
5:42
brought together pretty comprehensive team that's going
5:45
to focus on demonstrating the use of a mobile driver's license
5:49
or verifiable credential in online workflow.
5:51
So we've seen a lot of work being done by like TSA and other
5:54
organizations that are really heavily focused on how do we
5:57
solve for presentation of something like a mobile driver's
6:00
license in person. We wanted to take that to the
6:02
next level when we really start to look at how do we do this in
6:05
a non last year? How does IT support things like
6:08
identity proofing and verification steps that that we
6:10
typically use, you know, like a a driver's license, physical
6:13
driver's license document often capture for now, can we
6:17
potentially use this AAA set in the future and even gain more
6:20
confidence in it? So we've got some issuers, we've
6:23
got a couple wallet providers on board right now.
6:26
We've got an underlying identity and access management
6:28
infrastructure and then we got a whole bunch of financial
6:30
institutions. And so our first use case is
6:33
really focused on how do we show how we can use these things in a
6:38
customer onboarding process that is aligned to the customer
6:41
identification program requirements also known as like
6:43
KYC. So we, we announced that I'm not
6:46
going to attempt to list all of the participants that we have
6:49
because I will forget. One and they'll be able to be
6:51
mad at me. But let's just say we have a
6:53
very robust set of of partners, including some really important
6:56
financial institutions, some very big players in the space,
7:00
as well as some of the smaller companies and organizations that
7:02
are that are really looking to make some innovative steps
7:05
there. So that's that's one big thing.
7:07
You know that the next phases on that after we get this bill done
7:11
will be a government service use case and then a healthcare
7:15
service use case. So big announcement on that.
7:19
The other big announcement is we released our second public
7:21
comment draft of eight hour 63 revision 4.
7:24
And I think we'll probably talk a little bit more detail about
7:26
that as we go along. But in December of 22 is when we
7:31
put out the first public comment draft.
7:33
We, we subsequently had 119 day public comment period, which is
7:38
actually really long. Most of these are about like 45
7:41
to 90 days, sometimes even less. But we wanted to have a very
7:45
targeted outreach plan that went with it to make sure that we
7:47
were getting feedback from organizations that we don't
7:49
always get feedback from. So members of the, you know,
7:53
like the civil society space, academia and state and local.
7:56
So we went on a whirlwind tour to try and to try and get as
8:00
much feedback as we could there and it worked.
8:03
We got, I think it was about 130 a 140 organizations that
8:07
submitted gigantic lists of comments.
8:10
And once we broke those down, we had about 3876, not about we had
8:14
exactly 3000. About that seems pretty.
8:16
Roughly, very, very oddly precise.
8:18
There was a decimal point in there, I'm not sure where that.
8:21
We are NIST, you got to be as accurate as possible.
8:23
So, yeah, 3876 comments and we basically spent the the last
8:28
better part of the last year kind of breaking those down, you
8:32
know, figuring out what makes sense to keep and what makes
8:34
sense not to keep and, and, and releasing the update.
8:37
And, and we, we really decided early on, I think we actually
8:40
announced last August that we just, there's just too much
8:43
going on in this space to not do a second public comment draft.
8:47
So based upon the fact that we got so many comments, we're
8:50
going to make pretty substantial changes and the fact that
8:53
there's a lot of standards out there that are still evolving in
8:55
this space, pass keys, mobile driver's license, wallets,
8:59
there's still a lot that has changed even since when we
9:01
started this process a year ago. So we decided we really need to
9:05
have that second public comment period and and validate a lot of
9:07
what we changed. So that's where we're at right
9:10
now. I think both of those were they
9:12
were released on back-to-back days about two weeks ago.
9:15
So it's been a very, very busy period for us.
9:18
So when I asked you what's going on, not much.
9:20
Nothing. Nothing at all, kind of run of
9:21
the mall stuff. We're here at any week.
9:24
Let's start here. How's the conference been going
9:26
for you so far? I know you spoke yesterday.
9:28
Yeah, Spoke yesterday, talked on a panel focused on the big
9:32
question of cross-border interoperability, you know, and
9:36
some of the work we're doing in international standard space.
9:38
So work we're doing to support ISO work we're doing with W3C,
9:42
that World Wide Web consortium, Fido alliance and how we kind of
9:47
tie some of the underlying technical protocols together to
9:50
at least support, hey, I can share this information.
9:53
And then talking about how like 863 fits in from like a, a
9:57
framework perspective and assurance level perspective to
10:00
help convey the almost almost policy type things of should I
10:05
accept this credential? So this is a good panel.
10:08
Thought it thought it went really well, but you know, I was
10:11
on it. So I guess I'm a little bit
10:12
partial. I, I haven't got to as many
10:15
sessions as I would have liked because I did have a couple of
10:17
those side things that I had to deal with.
10:19
But I, I think one of the things I like most about this
10:21
conference is the fact that like, it brings people to me
10:25
speaking selfishly again, you know, it's not often we get a, a
10:28
pretty big comprehensive identity conference here in DC.
10:32
So the fact that, you know, we get to see a lot of vendors that
10:35
we don't necessarily get to see on a regular basis.
10:37
We get to learn about what innovations are coming out of
10:40
the technology space right now. And we get to meet with a lot of
10:42
folks that otherwise we'd have to, you know, connect with on
10:45
Zoom. It gives us a really good chance
10:47
for some face to face and a lot of really interesting vendors
10:51
and technology opportunities as well, too.
10:52
So as far as I'm concerned, it's a great, it's a great chance for
10:56
us to to, to engage with folks that otherwise, you know, might
11:00
be hard to find. Yeah.
11:01
I remember walking through the vendor hall yesterday with Jim
11:04
and you know, I recognize maybe 1/4 of the vendors that were
11:08
there and like, there's just, there's a lot, so many vendors
11:11
in this state. Of vendors, yeah, yeah, and.
11:13
There's a lot of innovation going on.
11:14
I think that's one of the things that's pretty cool is like you
11:17
get to see, you know, and it's not all one set of products.
11:20
Like sometimes you go to in conferences like this and it's
11:22
like 350 biometrics vendors and, and that's super useful if
11:27
that's really what you want to see.
11:28
But you got a nice diverse set of of of vendors you can check
11:32
out here covering things from DACA to biometrics to wallets
11:35
to, you know, to even some folks that doing doing stuff in like
11:38
the the trust frameworks out of the house.
11:41
I know Jim wants to talk about NIST 863.
11:44
Before I get to that though, I just want to ask you a question.
11:47
The panel I had yesterday was about navigating the future of
11:49
IM and the topic of self sovereign identity came up and
11:54
this whole idea of being in charge of your own account,
11:58
right? Or things like that.
11:59
And my thought process was, OK, that sounds cool.
12:03
I've heard about that for a while now, but I don't see it
12:07
yet happening in the real world. I feel like this is still kind
12:09
of the future. Where do you see things like
12:12
self sovereign identity coming through?
12:14
Because here's, here's my point is that one point during the
12:17
talk, when I was monitoring the panel, I actually asked the
12:20
audience, like, who would you trust to run this decentralized
12:24
platform that would need to be in place with us?
12:27
You know, government, nobody raised their hand.
12:30
You know, financial institutions, nobody raised
12:32
their hands. Education, still nothing.
12:35
Medical, still nothing. It's like there's a, there's a
12:37
trust thing there that people, at least in that room, were not
12:40
willing to trust a large entity like that to run it.
12:43
I'm just curious, where do you see SSI?
12:45
So I mean, SSI is tough because it's.
12:46
As a term. It's got a lot of like
12:50
preconceived notions and concepts and very strong
12:54
opinions, like on both sides of it, right?
12:56
Like, I mean, as a pure concept, I think it, it sounds really
12:59
cool, but the trust component of it becomes very, very hard,
13:03
right? There's a lot of, you know,
13:05
organizational trust that need to go into these things.
13:07
There's a lot of risk management that needs to go into how you're
13:09
going to accept and where you're going to accept an identity.
13:11
And that's still kind of an open question.
13:14
A lot of times with SSAI think there's a lot of trust placed in
13:17
the protocols and the technology and the cryptography.
13:20
But at this end of the day, there's, you know, there's still
13:22
questions of the verification process, the authentication
13:25
process and, and the proofing and the issuance.
13:27
And there's a lot of stuff that kind of starts to compound.
13:30
That being said, I think like the core concepts of providing
13:33
greater control to the end user is it's a no brainer, right?
13:37
Like these are things we should all be working towards to the
13:40
greatest degree possible. And I think that's something
13:43
that that we're starting to see take a little bit more of a
13:47
front seat in, in some of these concepts.
13:49
I mean, whether you're talking mobile driver's license, what
13:52
are you talking about? Verifiable credentials, what are
13:54
you talking about the European digital identity wallets, There
13:56
is definitely a move where you're abstracting some of the
14:00
control that had historically been maintained by like you know
14:04
a server sitting at a government service and you're putting that
14:07
control into the end user's hands.
14:08
Now, I don't think that's truly self sovereign, but it is it is
14:12
abstracting and at least pulling some of that control into that
14:15
user's into that user's possession.
14:17
And they're able to say, I'm going to present this here, I'm
14:19
going to do that this there, it's going to be mine.
14:21
You know, there's there's a degree of at least control that
14:24
I think gets increased there. Again, I don't think it's truly
14:27
self sovereign. And I don't know if anybody in
14:29
like the self sovereign identity world would would believe that
14:32
those are self sovereign. But I think they're a move
14:34
generally in the right direction to be able to grant more control
14:37
to end users. And I think particularly once we
14:39
start to see wallets that are able to maintain, you know, more
14:43
than one credential, you're going to see people be able to
14:46
add credentials, attributes, things that are verifiable about
14:49
themselves that aren't, that aren't necessarily like, you
14:52
know, a government controlled document, right?
14:54
Like not a, not an M doc from a, you know, ADMV, but like a, this
14:58
is an assertion of, you know, my credentials as a, as a
15:03
professional, or this is an assertion of, of some other
15:06
status about myself that is less centralized and, you know,
15:10
requires less tie back to some kind of authority that starts to
15:14
kind of blur those lines a little bit.
15:15
So I think the move in that direction is, is very positive.
15:18
And you know, NIST is obviously encouraging, you know, as much
15:21
user control as possible with the understanding that there's
15:24
degrees of trust, particularly on the government side, that you
15:26
have to have confidence in that you're not always going to get
15:29
like in a pure SSI model. Now there's probably SSI people
15:32
who are going to listen to this and be upset with me about
15:35
making some of those statements. But but we deal in the real
15:37
world. Yeah, these are things that we.
15:39
And specifically, we deal, I deal with it like government
15:42
and, and having trust in the authority that issued some kind
15:46
of identity verification, some kind of credential, some kind of
15:50
process is very important for managing risk.
15:53
And also making sure, like, you know, we have a responsibility
15:55
to protect people's data and we have to be good stewards of it.
15:59
And so being able to kind of understand what risks are
16:02
occurring by accepting a specific type of credential, you
16:05
can only get that with with having some knowledge of where
16:08
it originated. I think this topic deserves its
16:11
own episode. Love to have to come back and
16:14
talk about it. One thing I just want to start
16:17
with, this seems like you really love your job.
16:21
I, so I, I do really like my job a lot.
16:23
I think it's, it's got its own challenges, but like the breadth
16:28
of people that I get exposed to and ideas and concepts is
16:33
really, really cool. And there's a certain degree of,
16:37
of, of being at like the center of some of these conversations
16:41
that I like or I, I just really enjoy it.
16:44
Not everyone loves us all the time.
16:48
And that is, that is difficult because I do like to be liked.
16:51
But you know what's? The biggest criticism that that
16:53
you think NIST gets? It's, it's tough because it
16:56
depends. Like I, I think there's a couple
16:58
different ways to look at our guidance and some people see it
17:03
mostly as a security document. Other people want to see it more
17:07
as like a, an enabling document of like, hey, this is how I can
17:10
offer more services. You know, there's the, the, the
17:13
kind of perennial debate between how much risk do I accept versus
17:17
how much risk do I I focus on from a compliance perspective.
17:21
And so there's, you know, we might make a change that we
17:23
think supports like a broader accessibility issue and people
17:27
might push back and say, well, you might be slacking security a
17:30
little bit there. And a lot of times, you know, we
17:32
try and address that by providing as many pathways as
17:36
possible to be able to successfully complete like
17:38
identity proofing or authentication.
17:40
But at the end of the day, we're, I don't think we're ever
17:42
going to satisfy everyone. And the biggest thing is we're
17:45
like, we don't want to focus on compliance.
17:47
That that would be a, a, a, a, a most people want us to be about
17:50
compliance, but we actually want the documents, we want our
17:53
guidance, we want the tools we provide to be something that
17:56
agencies can use to manage risk in the best way possible.
18:00
Because at the end of the day, you're always going to have to
18:02
accept risk. You're always going to have to
18:03
deal with risk and you're always going to have to be able to do
18:05
it in a way that's most informed as possible.
18:08
So we like to see what we provide as a baseline that
18:10
organizations have the ability to adapt to their, you know, to
18:14
their their space. But there's a lot of people who
18:17
want to view it as a conformance documented to an extent.
18:19
It can be that as well, too. And so it's a tough battle
18:23
sometimes, but. The keyword there seems to be
18:26
it's guidance, it's not the law. Right.
18:29
It's definitely not a lie. It is like our guidance is
18:32
mandated by federal policy for federal agencies.
18:35
But that's the reason like you know, we have the entire first
18:38
volume is about risk management, right.
18:40
Like, and one of the big changes we we made in revision 4 back in
18:45
December and that we're, we're emphasizing even more now is
18:48
we've opened the aperture a little bit more for flexibility
18:50
for agencies to be able to make trade-offs between different
18:54
risk types when they actually do their implementation.
18:57
So it's less about rigidly saying if this then that I'm IL
19:02
2 and that's the only option that I have to implement.
19:04
Yeah. This conference is largely
19:06
focused on the public sector. If there is a a good share of
19:11
private sector as well. One of the things I've really
19:13
been, I shouldn't say, surprised by, but that I've noticed over
19:17
the years is that this is also heavily followed and heavily
19:24
aligned to from a private sector perspective.
19:27
Do you guys keep that in mind as you're developing these papers
19:31
or is that just a secondary concern?
19:33
No, absolutely. I mean, yes, our primary
19:35
audience and consumers are the US federal government because
19:39
they have to implement what we what we put out.
19:43
But we very much take into account the broader ecosystem
19:47
and we also take into account that people turn and look to it.
19:51
I think the benefit that the commercial space has is they can
19:53
kind of pick and choose where they want to apply certain
19:56
things. And that's, that's not really a
19:59
problem for us as well, too, right?
20:00
Like ideally, if we're all using the same baselines and talking
20:04
about the same concepts and using the same, the same
20:07
paradigms, it's much easier to communicate amongst ourselves
20:10
about what we're doing, what we're not doing.
20:12
So we do take that in mind. We take we take feedback from
20:15
everyone. So I mean of the 3876 comments
20:19
that we got. Roughly, give or take, 70% of
20:23
them came from commercial entities.
20:25
Now there's an overlap there of commercial entities that are
20:28
also providing services to the federal government or consulting
20:31
for the federal government. But you know, we got a very
20:33
broad range of, of feedback, like, you know, we had gambling
20:37
sites providing feedback to us this time around too.
20:39
So it's, we take feedback from everywhere and, and honestly, we
20:43
want to make sure we're, we're bringing in best practices and
20:45
leading practices and security controls and accessibility
20:48
controls from everyone because the US government doesn't know
20:52
how to do it better than anyone else.
20:53
We all learn from each other and we're all going to be able to,
20:56
to leverage certain kinds of concepts together.
20:58
And that's why we, that's why we do it right.
21:00
It it's about, you know, NIST does not know absolutely
21:03
everything and we are not infallible.
21:06
And because of that, we try to have a process that is
21:08
transparent, open and brings in the best from all across both
21:12
industry and government. Now it's turned around in a
21:14
guidance that's mandatory for the federal government.
21:16
But you know, it's, it's really something that's kind of a
21:19
community contribution, community effort, right?
21:22
So. Of the 3876 comments roughly
21:27
roughly aren't were they mostly constructive or what's your
21:30
process to consume and. Reflect those.
21:34
I love that question like what's a high quality comment?
21:36
What's a low quality comment? Honestly, like, I mean, we, I
21:42
don't think we got one that said we stink, but you know, we, most
21:45
of them are, are very high quality and constructive.
21:48
Like, I think people who send comments understand our process,
21:52
understand that we take all these things into account, like,
21:55
and so I think it's they submit comments because it's important
21:59
to them and they're not going to submit comments that basically
22:02
just say, hey, look, we don't like any of this because that's
22:04
not constructive. That's a waste of their time and
22:06
it's a waste of our time. You don't see a lot of trolling
22:08
in the comments. There's sometimes a.
22:10
Little bit of trolling, but it's more of like in the tone of the
22:13
comments. Normally what's being said in
22:15
the comment is still very constructive and helpful, but I
22:18
would say the almost all of them are are are are like technically
22:21
constructive and helpful and sometimes tone changes.
22:23
But, but at the end of the day, like almost all of them are
22:26
helpful, you know, but they'll also range from anything like a
22:30
y'all forgot a comma on this page to hey, you know, y'all
22:34
didn't explain this, you know, public key encryption process
22:37
correctly. So there's, there's a very broad
22:40
range of like what the comments focus on, but they're, I mean,
22:44
they're almost all constructive. And, and I think because of the
22:48
fact that we open the door to so much this time around, we got a
22:51
lot of really, really good feedback, like really good
22:54
feedback this time. What does a synthesis process
22:57
look like to take 3876 comments roughly to take all that data?
23:03
Do you Is there like? We put them in a hat.
23:05
We. Shake it up.
23:06
Shake it up a work dump it on the floor.
23:09
No. Do you?
23:10
Do you Do you bucket them into different areas?
23:12
So, So what we do is we, we kind of get the initial set of
23:15
comments and we triage them and we classify them.
23:18
We use GitHub to do this. So we, we make them all issues
23:21
within GitHub and then we, we give them like tags.
23:25
So we'll say, you know, this comment is editorial, like, you
23:28
know, you spelled your name wrong or something like that.
23:30
Or your name appears twice on 63 A, which it currently does in
23:34
the draft of 63 A. Yeah.
23:37
So we'll bucket them into like, hey, here's like the editorial
23:39
stuff. Here's the stuff that's that's
23:41
kind of more substantive. And then we'll go in and further
23:45
triage those and say, hey, look, you know, these are things that
23:48
are like red, red lines for us. So we just, you know, we can't
23:51
do like, hey, tell everyone they have to submit, you know, their
23:55
fingerprints through the FBI in order to get identity proof to
23:57
whatever, you know, like the things that are just not going
24:01
to happen. And then we'll have the things
24:03
that we we know we need to have some kind of control and debate
24:05
on. We'll also typically have tags
24:07
for like, hey, this comment seems really valuable, but we
24:09
don't totally understand it. We need to go have a
24:11
conversation with someone. So we'll we'll tag some things
24:13
for follow up and then we just start working our way down the
24:16
list. We have, you know, we have teams
24:18
that support, we have contractor support that, that are all like
24:22
our, our editors and stuff like that.
24:24
They're fantastic, fantastic team.
24:26
And they'll be responsible for each volume.
24:28
Then we'll work our way through all the comments for each one.
24:30
And then that's why it took a really long time to get through
24:33
all those and we'll just kind of check them off as we go.
24:36
The one thing we do often find ourselves in a tough place on is
24:39
like, you know, we'll, we'll have a conversation.
24:41
We'll be like, yes, we're going to accept this comment and then
24:44
we'll get all the way down here. We'll be like, Nah, we're not
24:46
going to accept this one. And as we start to write, we're
24:48
like, wait a minute, it was the same comment at one point we
24:51
thought we were going to do. And then so we have to do almost
24:53
like, you know, like an initial round of vetting and then we
24:55
follow through. And then as we start to write
24:58
and we start to make sure we've captured all the items we want
25:00
to capture. Sometimes we have some
25:02
additional debates. But you know, I think the good
25:06
news with this was there's some really good bucketing that we
25:07
could do. So we were actually able to in
25:10
August of last year, like the really big picture items where
25:13
we had a lot of really common comments in our initial
25:16
assessment, we're able to provide an update.
25:20
It was, it was a year ago in August that basically said,
25:22
here's the things we think we're going to do, like based upon the
25:26
initial huge buckets of feedback, not like all the
25:29
little ones, but like the, hey, here's the five major ones.
25:32
This is what we think we're going to do and we're able to
25:34
get some initial feedback on it. So I think that was, I think it
25:37
was really helpful for us to do. We've done that in the past on
25:40
other special publications as well too.
25:42
But that gave us a chance to like vet some of our initial gut
25:45
instincts and share some of the initial planned direction we're
25:49
going to take. Is it?
25:50
Clear now what the timeline is so you update the dry off key.
25:54
Do you have to have another public comment period and then
25:58
another revision period? Like when does this thing stop
26:01
and never? It just keeps going for, just
26:02
keeps going right. It's like identity, yeah.
26:05
So, so we will, we will not, we will most likely not be doing an
26:08
additional public comment period.
26:09
I'm not going to say no because sure, there could be something
26:12
that causes it, but the intent is 45 days.
26:16
Public comment period closes on October 7th and then we will do
26:20
the final depending upon how many comments we have sometime
26:25
after that. I, I, I think we'd like to see
26:27
it sometime early next year, but it's a cycle.
26:31
Right. And then it starts over again
26:33
or. We, we, it, it will start over
26:35
again eventually. So like we will probably, what
26:38
we'll probably do is we'll let it out, we'll get it final and
26:41
then we'll start to collect like some initial feedback is
26:44
implementers put it in place and then probably a year, 2 years,
26:48
depending upon how things are going.
26:50
We'll do a couple of sensing sessions.
26:52
Hey, do we need to open this back up again?
26:54
Are there any major changes? And then we'll make a decision
26:58
about whether we're going to do another revision or not.
26:59
And we'll probably do that on an iterative cycle based upon like
27:03
what we're serving in the in the broader community.
27:06
I kind of refer to 800-63 as kind of like the Bible for our
27:10
industry. So can you kind of cover what we
27:15
can expect to see in this update?
27:18
Yeah. So I I think the big things are.
27:25
So we're just doing more of what we did in in when we released
27:29
the draft in December of 22. So, you know, we in, for
27:33
example, in the base volume, we went away from this kind of,
27:37
some people really love them. This is actually one of the more
27:39
controversial things. But like we had these flow
27:41
charts in 63 in the base volume where the risk management
27:44
section was. And, and a lot of people like,
27:48
love the fact that they could be like, I'm going to answer all
27:50
these questions, going to tell me exactly where to show
27:52
something to be at. And there's something to be said
27:54
for that. We also heard from a lot of
27:55
people who are like, I am hamstrung by the fact that this
27:59
says I have to be here and I want to do better risk
28:03
management to be able to say, look, I, I'm going to, I'm going
28:06
to accept some risk or manage some risk.
28:07
And it puts me in a very difficult position from a
28:10
compliance perspective. So we wanted to kind of take the
28:13
two concepts of being able to have flexibility, but still
28:16
having some kind of structure. So in, in that December update,
28:19
we, we basically shifted away from those kind of more
28:22
structured line down the middle end up where you're supposed to
28:26
end up to, to more of a process oriented approach, something
28:29
akin to what's in the risk management framework.
28:31
We actually was inspired by the risk management framework.
28:33
So it's basically got a set of steps and processes, you know,
28:37
started with like, you know, identifying your insurance
28:39
level, doing a tampering process to understand, do I need to
28:43
maybe adapt this and documenting it, all that stuff.
28:45
Do your impact assessment. So basically added one
28:48
additional step to that. So a lot of people basically
28:50
gave feedback of how do we make sure we're kind of setting the
28:54
context correctly here? How do we make sure we're
28:55
getting all the right information?
28:57
So we've, you know, folks who are familiar with like 853 in
29:01
the RMF there they talk about like the step 0 where you're
29:04
like, get all the information you actually need.
29:06
So we've added an additional step into the base volume in the
29:09
risk management section that says like define what this
29:12
application is that you're protecting, understand all the
29:16
users that you're going to have. Because what we were also
29:18
worried about and heard feedback was people are going to think,
29:21
because I have one user who said AL2IL2, whatever it might be,
29:27
all my users need to be there. Well, that's not necessarily
29:29
true, right? Because you can have
29:30
administrative users who have a different risk profile than your
29:33
public facing users that have a different profile than, you
29:36
know, your, your government employees who are accessing the
29:39
back end or something like that. So there's a lot of different
29:42
assurance levels that one application might have based on
29:45
what the users actually doing. So I want to make sure we better
29:47
set that contacts and said, Hey, look, you can, you can actually
29:50
like think more discreetly about where to apply the assurance
29:54
levels. It's not a blanket if app is at
29:56
this level, then everyone who comes near it has to be at this
29:59
level. The other thing we did?
30:01
I laughed at that just because, like, I could see a lot of
30:06
people in the private sector, especially to be like sub zero,
30:09
get information about the app, like, I don't know, OK, can't do
30:12
that, don't have that. Yeah, that's going to take six
30:15
months. Yeah.
30:17
And, but, but I mean, that is, and I think the, the, the
30:20
important thing to remember is that like identity systems don't
30:22
exist for the sake of having an identity system.
30:25
They're protecting. We're enabling access to
30:27
something. So you need to understand what
30:29
that thing is in order to make the right decisions about what
30:32
to put in place is to, to protect it.
30:34
The other big thing we did was, you know, we had in, again, in
30:37
the draft that we released in December, we talked about
30:40
continuous evaluation and improvement.
30:42
This is the, the last step in that kind of risk management
30:44
process. And people were like, we, we
30:46
love this, but you wrote like 1 1/2 paragraphs on it and we
30:50
don't really know exactly what we should be monitoring and
30:53
evaluating. We got a lot of really great
30:57
comments and that's like really great comments.
31:00
And so we have, what we've done now is we've taken that section,
31:02
expanded a little bit more on like the how the relationships
31:06
you need to establish, etcetera, and then focused on a set of
31:09
recommended metrics. I do not have them all memorized
31:12
because I think we got about 20 in there.
31:14
But this is, you know, people were basically what are the
31:16
things we should be paying attention to, to know if we're
31:20
meeting our outcomes and objectives.
31:22
And not all of them are identity specific data elements.
31:25
But, you know, looking at things like failure rates, pass rates,
31:30
fraud rates that confirm fraud rates, looking at things like
31:34
the types of authenticators being used, where you're having
31:37
challenges in the process. So like where you're getting
31:39
calls to your help desk saying I cannot get through this process.
31:43
If it's one person, it's one thing.
31:44
If half the people calling your help desk are calling about the
31:47
exact same step in your identity process, you probably have
31:50
something you need to address. And a lot of those things
31:52
require you to have relationships with components
31:55
that are not your identity team, right?
31:58
You need to have a relationship with your call center.
31:59
You need to have a relationship with your fraud team.
32:01
You need to have a relationship with your UX teams that are
32:03
doing these things. So we don't mandate all of those
32:08
require all those, those metrics get collected.
32:11
What we do say is like, you should be collecting these if
32:14
you can, and if you can't, you should be starting to establish
32:16
those relationships to be able to pull it in because not
32:19
everyone's going to have that same level of maturity, I think
32:21
out of the bat or out-of-the-box rather.
32:23
But, but like a lot of those metrics were things that people
32:26
recommended directly to us like, hey, this is what we've been
32:29
collecting and This is why it's been helpful for us.
32:31
And so I think that's been, you know, those are some of the best
32:33
comments I think we got on the on the overall.
32:35
The recommendation is to collect those things to what and to
32:38
prevent we're to identify fraudulent access.
32:43
That's one thing, right? So it can be, hey, you know,
32:46
we're, you're tying in where successful fraud has come
32:50
through your system, tying it back into your identity
32:52
management team and saying we need to fix something because
32:56
you're not stopping this. You're not stopping that your
32:59
doc off isn't working and and fake documents are getting
33:02
through, whatever it might be. So that there's that feedback
33:05
cycle from a, a security perspective, but it's not just
33:07
security, right? Like it can very much be we're
33:10
losing a lot of people from a an accessibility perspective
33:14
because something in the identity system is broken,
33:16
right? Like your password reset is
33:18
terrible. Your your your biometric is not
33:22
performing the way you thought it was going to Your doc auth
33:24
isn't getting the performance. Your where everyone's confused
33:27
about the instructions. Like it can be very it doesn't
33:30
even have to be technical. It can be things like.
33:32
User experience kind of stuff users are taking.
33:34
The pictures of their documents at the wrong angle or it's too
33:38
dark. Like you need to add cues to
33:41
help people understand because there's a lot of stuff that like
33:44
you can have a fully compliant system that is absolute
33:46
terrible. So, so the, the goal here is to
33:50
focus less on I'm compliant, let's move on.
33:52
It's all right, I've built a system.
33:55
How do I continue to make this most secure I can possibly make
33:59
it? How do I continue to make it as
34:00
usable as I can possibly make it?
34:02
And how can I address issues as they come up in a rapid manner,
34:04
right? Because without those feedback,
34:07
you could go on for months and think, you know, I've this is
34:09
just how my system works and when actuality you could be
34:13
improving it and kind of fixing it's OK, whatever it be.
34:16
Right. I mean, yeah, just because you
34:18
build something doesn't mean it can't get better.
34:19
Yeah. Yeah.
34:21
So that's fantastic. You mend over a couple of like
34:24
big changes. Are there any smaller things
34:27
that you think are maybe minor changes that are going to have a
34:31
big impact? Let me tell you one more other
34:34
big change because I I only got through the baseball all right.
34:37
How long do we have? Obviously the one other major
34:40
change I do want to touch on because it is probably the most
34:43
major change is we've added the idea of user controlled wallets
34:47
into the guidance in this kind of Harkins to some of the MDL
34:51
verifiable credentials, self sovereign identity, whatever you
34:53
want. I kind of bucketed it as type
34:56
conversations we were having earlier.
34:57
So in the base volume, you know, we have a list of like here's
35:00
the cool digital identity models you should be thinking about,
35:03
federation CSPS, all those other stuff.
35:05
We've added a model in there that kind of aligns the
35:08
practices that we've historically talked about in the
35:11
guidance with this idea of a of a, of a user control wallet and
35:16
then an 863 C, which is our federation document.
35:19
We've basically laid out the specific requirements for how
35:22
you present something out of that wallet.
35:25
We call the match rebundles others, we'll call them
35:27
credentials. We didn't use credentials
35:29
because there's some fuzziness and, and how others use that
35:33
term versus how we use it. But basically here's how you
35:35
present something out of a wallet in a secure, reliable,
35:39
trustworthy manner so that a reliant party consume it.
35:41
Whether they're using it for proofing, authentication doesn't
35:44
really matter. This is what you have to do in
35:46
order to present that out. So that's a huge, huge change.
35:49
We have said in the the draft previously, hey, you can use
35:53
these kinds of tools and people like have.
35:56
So we tried to get a little bit of the how and a little bit of
35:59
protection around the actual exchange of those credentials as
36:02
a lot. So that's another like big, big
36:04
change, but like little smaller changes as far as like the
36:07
volume that'll have a big impact. 863 B we have updated
36:15
the account recovery language. One of the biggest complaints we
36:20
had about 63 B was this section is a little confusing.
36:24
It could be a little bit clearer and it's it's hard to figure out
36:27
how we can actually do this process as scary as possible.
36:30
So we've restructured it. It's not like a ton of content,
36:34
so it's a smaller like volume change, but I think it's going
36:36
to be pretty impactful as far as like we've described the process
36:41
as a bit more discreetly. We've also opened the door to a
36:44
few things that we learned about from like the commercial space,
36:46
things like, you know, potentially setting up a trusted
36:48
contact that can help you recover your account during the
36:51
identity proofing process or during the account establishment
36:54
process. There's a number of commercial
36:56
vendors that allow for that kind of a, a support process.
36:58
And then we've mapped what kind of account recovery steps can
37:01
support which levels of assurance so that there's a, a
37:05
better balance of knowing like I'm not going to use a, a very
37:08
low assurance recovery process for a high assurance account.
37:12
So I think that's one of the smaller changes from a like a
37:17
like a volume wise, but it's, I think it's going to be, I'm very
37:21
happy to see how people respond to it because I think I think
37:24
we've done a pretty good job with a day at.
37:25
Yeah, you mentioned the document.
37:27
So 800-63 is in three documents, right, AB and four documents.
37:33
OK so I'm only familiar with AB and C, but maybe go over.
37:37
What so we have, we have the base volume which is just 863-4
37:41
somewhat confusingly and that covers your digital identity
37:45
model. And it's basically just setting
37:46
like how are we going to talk about all these concepts for the
37:48
rest of these volumes. And then it's your risk
37:50
management process. So how do you assess risk,
37:53
evaluate risk, understand impacts to your programs and
37:56
then put in place the right assurance levels and document
38:00
those assurance levels and continuously approved.
38:02
Now then 63 A covers the identity proofing process for
38:07
like your commercial folks out there.
38:09
It's like know your customers. Like how do I how does this
38:11
person go from someone I have no idea who they are to someone I
38:14
have enough confidence in their identity to allow them access to
38:16
an account and issue them a credential. 63 B is the
38:20
authentication component. So now that I've got confidence
38:23
in the identity, I can issue them a secret so that they can
38:25
use it to authenticate in future.
38:27
So I don't have to put them into the pane of identity proofing
38:30
every time they want to access their account.
38:31
And the 63 C is the concept of federation.
38:34
It covers all of our federation requirements.
38:36
So how do I share identity information either with someone
38:39
who's relying on me to do all of the identity proofing and
38:42
authentication processes or how do I share it even internally?
38:45
So things like single sign on or from one, or from one part of
38:49
your organization to another that might not necessarily have
38:52
the same user directories and stuff like that.
38:54
So does did you ever get to a point where you're like maybe
38:57
that structure is not the right one to go with going forward?
39:00
You brought the SSI scenarios, you said you plug those into
39:05
Federation. Was that like the natural place
39:08
for it, or did you start to question whether or not there
39:12
should be A-D? So just to be clear, it's not
39:18
like SSI, it's more of like if there's something in a wallet,
39:21
whether that's an SSI credential or MDL or something like that.
39:24
So I just want to make sure that's clear.
39:26
But no, I mean, we had a pretty long debate about how to deal
39:30
with wallets and, and I think I think it makes sense where it
39:35
is, The team thinks it makes sense where it is.
39:37
We'll see what people think. But at the end of the day, the
39:41
way we looked at it is the wallet is essentially acting as
39:44
an identity provider. It's going to provide an
39:46
assertion to our line party that says this person is who they
39:50
claim to be. And here's the evidence for how
39:51
you do that. Whereas in a traditional model
39:54
that's coming from, you know, like a, a server maintained by
39:58
an organization that's done some kind of a process and you have
40:00
more like an organizational connection there, they're
40:03
probably presenting assertions for a whole bunch of different
40:05
people. You know, that's that's your
40:07
traditional IDP. The wallet is basically ask
40:10
acting as an IDP where they've pulled in information from the
40:12
CSP and they're going to present that information out, you know,
40:15
the issuer, they're going to prevent that, present that
40:17
information out to the relying party.
40:19
And a lot of the. Protocols and techniques are
40:22
very, very similar to the traditional federation protocols
40:24
as well too. So from our perspective, it
40:26
just, they made the most sense. It's just IDP where or
40:29
federation where the ID PS moved to a different location that's
40:32
in control of the of the end user.
40:35
Now it does change the trust model a little bit from a
40:38
traditional approach, but we, you know, we hopefully have
40:42
addressed that in the in the context that we've laid out.
40:47
So we've been talking to here for a little bit and I want to
40:50
make sure I can get you back out to the show here.
40:53
Do you have a favorite identity week moment?
40:57
Did something happen conversation and I can't do this
41:02
because obviously this? Is the this is the highlight of
41:05
my identity week? I would say the big thing for me
41:10
is just the side conversations. Like I don't have one side
41:12
conversation that's jumped out so far, but just being able to
41:15
walk around and see all these people that I typically only get
41:18
to have, you know, zoom chats with.
41:21
So the face to face I think is the highlight and the and the
41:24
connections. You can't.
41:24
Replicate that online. You can't.
41:26
You can try. But you can't.
41:28
Yeah, it's the the spontaneity of it, I think is the important
41:31
part. It's like, oh, hey, what are you
41:32
doing here? And sure, some type of new
41:33
plans. But, you know, I think we're
41:35
probably the same as like we're walking through the hallways and
41:37
then someone kind of grabs you. Hey, how's it going?
41:39
Yeah. And those are the for me,
41:41
that's. That you end up talking about
41:42
some innovation or concept that you weren't, it wasn't even on
41:46
your radar and you're like, well, I'm going to go find a
41:49
nice quiet place and do research for half an hour about what
41:52
we're talking about here so. I've shared this story before
41:54
but it was AI think it was a couple of coal conference that I
41:59
went to a while back. It was in Seattle and Rodger
42:02
Grimes, we had had him on the show at some point and I kind of
42:06
walked over and introduced myself.
42:07
This is very early on when we started recording and we got
42:10
into AI want to say like an hour long conversation about quantum
42:14
computing about 3 or 4 years ago.
42:17
And that never would have happened in any other context
42:20
other than him being kind enough to like answer my newbie
42:23
questions about I don't understand this thing like what
42:26
is it? And he was so kind and gracious
42:28
with his time there. And that's.
42:30
I think that's kind of like the spirit of the conference anytime
42:34
where you go to having those hallway conversations.
42:36
And I think that's what I like about this is, is because I get
42:38
those chances and those opportunities.
42:40
So like I said, unfortunately yesterday outside of my session,
42:44
I was a little bit hijacked by a couple of other work items that
42:47
needed to be taken care of. But I'm excited today because I
42:51
have an opportunity to go to much more things.
42:53
So I. Have one more question for you.
42:56
SO a lot of the folks who listen to a podcast are new to the
43:00
industry and just learning about identity.
43:02
And I think one of the fundamental concepts in 863 and
43:06
you referred to it a few times is this level of assurance
43:09
framework. So could you just kind of give
43:12
an introductory level explanation of what that's all
43:16
about? Yeah.
43:17
So we have essentially what we do within the risk management
43:21
process is we, we, we kind of start with like, look, let's
43:26
assess the application. Let's understand what the
43:28
impacts of would be of what, what if there is a failure here?
43:31
What if someone got access who shouldn't get access, right?
43:34
And that allows you to understand, is this going to be
43:36
a high risk application, moderate risk risk application,
43:39
a low risk application, But what do you do with that?
43:42
OK, I've got all that. Well, we've established to be
43:45
able to help provide an initial baseline of what should I be
43:48
doing the insurance levels and the insurance levels are broken
43:51
into three different parts. We have identity assurance.
43:54
How much confidence do I have in the initial identity
43:58
authentication assurance? How much confidence do I have
44:00
that this person is person originally enrolled and
44:03
registered and that they're presenting an authenticator that
44:06
I trust in the Federation insurance level.
44:08
So how much confidence do I have in an identity that's being
44:12
asserted to me through some kind of a federation scenario?
44:15
And so you'll go through and then you'll be able to say,
44:16
look, all right, if I'm at low moderate or high, I'm going to
44:19
pick, I'm going to start with this assurance level, this
44:22
assurance level and decision level.
44:24
And each one of those is targeted towards kind of like a,
44:26
a risk pattern, right? Like our IO1, which is a little
44:29
bit different now than it was in 63 three, you know, is like,
44:34
hey, it's just let's, let's deal with the big scalable attacks,
44:38
the ones that are kind of low hanging fruit and make sure
44:40
you've got some baseline controls that support, you know,
44:43
stopping that 80% of of, of bad guys.
44:46
Then you start to move on to IL 2 and you realize, all right, we
44:49
need to have a bit more confidence in who this identity
44:51
is. So you're adding a bit more from
44:53
an evidence perspective. I need more evidence of who you
44:56
are. You've got more stringent
44:57
validation process. You've got a stricter
45:00
verification process to make sure that, you know, the person
45:03
sitting on the other end of that laptop is actually the person
45:06
who that they are, who they are claiming to be.
45:07
And was in possession of that evidence.
45:09
So we, we essentially have buckets of controls that we're
45:12
trying to deal with and buckets of risk we're trying to address
45:15
with each one of those assurance levels.
45:17
But they're only baselines, right?
45:18
They're intended to be a starting point because you might
45:21
find IO2 works great for most of your controls, but or most of
45:26
your threats, but you might have a very specific threat in your
45:30
organization or to your process that you want to address.
45:33
We're not saying don't add controls.
45:35
I'm not saying don't take controls away.
45:37
We're saying start here and then document a process of tailoring
45:40
to meet your specific needs from that point.
45:42
And that gives everyone an understanding of where are we
45:45
all starting from to talk about from a like an interoperability
45:49
perspective. And it also gives you a point to
45:51
go back to and say, this is where we had to make some
45:54
changes or to fit our organizational perspective.
45:56
Like our authentication insurance level is a great
45:58
example. That is AAL 2.
46:00
Like we have a lot of different authentication options that you
46:02
can, you can select from going from like you know, SMSOTP,
46:06
which we don't like, but we have to maintain for for specific.
46:10
Reason. Still better than nothing.
46:12
Exactly. And you might have users who
46:13
don't have a smartphone. That's the case.
46:15
They don't have many other options for multi factor
46:17
authentication all the way up to a hardware key.
46:20
You might make a decision based upon your user population.
46:24
I'm not going to accept the risk of using SMSOTP.
46:26
That is perfectly fine. That is just one option at that
46:29
authentication insurance level, so you can adapt from there.
46:32
What is specifically important to you within those insurance
46:35
levels? So AL one assurance level 1 is
46:40
like user name and password in 63-3 and AL2 is user name and
46:46
password plus an MFA and assurance Level 3 is stronger
46:52
MFA. Blood sample.
46:53
Genetic sample. You have to actually sacrifice a
46:57
child as it gets, really. Wild.
46:59
Be careful what you say, you know.
47:01
People might take that as. You know the law.
47:03
No, so, so, so the the big thing that the big distinctions we
47:06
have at this point are single factor authentication, typically
47:09
username and password multi factor authentication that can
47:12
range at AAL 2 and that can range from again, SMSOTP all the
47:16
way up to, you know, your hardest of hardware
47:19
cryptographic authenticators. When you get to ILAL three,
47:23
we're talking about fishing resistance and we're talking
47:25
about non exportability of of cryptographic keys.
47:29
So you're really at that point talking about very strong,
47:34
either platform based authentication or hardware based
47:36
authentication where you have a high assurance that that that
47:40
key hasn't left and it's not going to be finished.
47:42
So in practice, you know that's going to be something like a
47:47
Fido token, hardware Fido token, a platform authenticator that
47:51
can't be exported, or something like a PIV card that you know
47:54
you have as a federal government plate.
47:56
Do those change in dash 4? No, they said the only thing
47:59
that's really changed in Dash 4 along those lines is at Al two,
48:05
we allow for export ability. So back in Dash 3 you could not
48:09
do that. But what we've seen is kind of
48:12
this expansion of this idea of we call them syncopal
48:15
authenticators in the guidance because Passkey is kind of a
48:19
borderline like copyrighted, might even actually be
48:22
copyrighted. But basically this idea of, of
48:24
you can have a fishing resistant authenticator that is way better
48:28
than using like something like SMSOTP, but it's not the same
48:31
level of assurance as something like an AL 3 authenticator.
48:33
So we do allow for that. We've got we wrote a a
48:36
supplement to 863 three in April that basically said you can
48:41
start to use these things under certain conditions and we've
48:44
added all that content in. So we've we've created a space
48:47
for essentially we'll say the passkey's passkey world at Al 2
48:51
in order to support multi factor authentication and in particular
48:54
efficient resistant A. Lot of folks are looking at this
48:57
at how do I apply this level of insurance framework for a my
49:01
government to citizen scenario or my business to conserve a
49:07
scenario. But I think AL 3 almost sounds
49:11
like that would apply more in my internal workforce, like when I
49:16
start to get to, you know, administrators or privileged
49:19
access. Yeah, you could, you could
49:21
conceive of use cases where AL 3 might make sense for certain
49:26
mission partner type use cases where you know, if you've got a
49:30
partner organization that also has like if you're in the
49:34
federal government, you got a partner organizations that have
49:36
also got PIV cards, you're not going to do a lower level of
49:39
authentication just because they're not part of your
49:41
organization. You could also conceive of very
49:44
small scenarios where you might issue people something like a
49:47
PIV card or a hardware authenticator because they have
49:50
some kind of elevated role in information sharing or something
49:56
like that. But for the most part, yeah,
49:58
like you're you're public facing applications are probably going
50:01
to fall into AL 2 in most instances, particularly if
50:05
there's anything sensitive that those applications are
50:07
protecting. But it not it's would be we're
50:10
not, we're not telling you to go out and issue the general public
50:13
eBay keys or or Fido tokens or something like that.
50:17
Yeah, you can allow it if you've got one.
50:19
But we're not, we're not asked of, you know, agencies to go out
50:21
and Stewart. Boring.
50:22
Here's your Social Security number, and here's your hardware
50:24
token. Yeah, I mean.
50:29
We need to do something about issuance.
50:32
I'm I'm not saying we should. Be doing that.
50:33
Better, I mean one of the big problems we have in the country
50:36
is that like you know there's not ultimately a lot of our our
50:40
core identity is tied back to very simple documents like birth
50:44
certificates that are not hard to full supply.
50:46
So doing better at that early level is going to be really
50:50
important. Obviously not issuing people
50:53
fight up tokens at at that level, but I'm still thinking.
50:57
Yesterday of the future of identity, right?
51:01
Yeah, right. Cut the Star Trek 10.
51:02
That knows who I am. And and there is, there is good
51:05
work being done by a lot of organizations in that like
51:09
breeder document space of how can we start to have more
51:12
confidence in those in those core documents like at the
51:15
earliest phases of our, our existence really.
51:17
So all right. Anything else?
51:21
Leisure. No.
51:22
Leisure. No.
51:24
Before I hit record, you were talking about some existential
51:27
questions that you had recently posed.
51:30
Let's talk real quickly about that.
51:32
Explain the scenario for people who weren't in the room with us.
51:34
Yeah. So, so my son, he's five years
51:37
old and we were talking about how like, you know what, you
51:40
know what phases of life with the kids we we like the best.
51:44
I also have a daughter who's one and she's just getting close to
51:47
standing and walking. So that's about to get even
51:50
scarier. But my five year old I got, we
51:53
were talking about how I think 5 might be my favorite age so far
51:56
'cause like when they're like like 4 years old, they start to
51:58
ask a lot of questions, but very basic questions like why, why,
52:02
why, why, why, why, why, why why.
52:04
And you're like because that's. Right.
52:06
Yeah, every parent out there probably knows the answer.
52:10
Oh absolutely. And, and but, you know, my son
52:12
is really starting to ask these Really well thought out,
52:15
carefully crafted, thoughtful questions.
52:19
He's been reading the this documents behind.
52:21
Yeah, yeah, I hope not. But he, we were driving the I
52:27
was taking him, taking him home from school a couple days ago.
52:30
And he was really quiet. He was just staring out the
52:33
window. And all of a sudden, you know,
52:35
he he looks at me in the front seat and he says, Dad, what if
52:39
nothing existed? What if there were no planets or
52:42
people or trees or grass? I don't know why grass and trees
52:46
got involved, but Elsie, I don't even know how to Five years old.
52:51
I don't even know. I was, I was a little worried
52:53
because of how existential it was, but I I had no idea how to
52:56
answer the question. I was like, I think I ended up
52:59
diverting on to like, hey, did you see the sign for the new
53:02
Wendy's that they're putting in across the street or something?
53:05
Yeah, the Frosty's. And he was like, you're avoiding
53:08
my question. But yeah, I mean, he just asked
53:11
these super interesting, super fun questions.
53:15
I'm a big history podcast guy. So he's, we listened, we
53:19
listened to a podcast about like Bronze Age culture and there's
53:24
this whole concept of like the Sea Peoples.
53:26
And he's like, I don't understand this.
53:28
You're going to have to explain this to me in much more detail.
53:31
And I'm like. Dude, I'm at my desk by
53:34
tomorrow. Yeah, I'm like, I don't know,
53:36
just just enjoy the podcast and listen to some.
53:39
You have a Doogie Howser on your hands.
53:42
Yeah, I mean, he's, he seems very intellectually curious.
53:45
We'll put it that way, you know. The throne of that you won't get
53:48
from I approved by any chance? No, I'm sorry.
53:51
We're in the middle of recordings.
53:52
Yeah. I'm proud.
53:55
On a lighter note all. Right.
53:56
So we are at a conference, just FYI.
53:58
Yeah, we. Weren't faking this.
54:00
Yeah, this is not a deep fake. Yeah, do.
54:01
You get any existential questions from your kids?
54:05
I'm sure I did. They're all teenagers now.
54:07
So it's kind of hard to to bring myself back to specific
54:12
questions. But I do remember thinking about
54:15
questions like one that Ryan mentioned earlier.
54:17
It's like, why don't we all just float away?
54:19
And I was like, yeah, I remember getting questions like that.
54:22
And the challenge is, what is what level do you explain
54:26
gravity at? You just say it's because of
54:29
gravity. And some kids will just say, oh,
54:31
gravity, OK. That makes sense.
54:33
I don't know, it makes sense but OK.
54:35
But then it's OK. Well, how does gravity work?
54:37
Yeah, we have the planet spinning and it's pulling
54:40
everything towards. Here's a Neil deGrasse Tyson
54:42
video. Watch that.
54:42
Yeah, yeah. And he does a wonderful job of
54:45
describing those things. He makes things fun.
54:47
Yeah, yeah, gravity. Gravity was a fun one.
54:50
I don't remember how I think my wife got that question and I got
54:53
to hear about how she explained the answer, but she's my wife is
54:57
huge into spades and astronauts and stuff like that.
55:01
So we were driving home the other day and and my brother,
55:04
my, my, my son said, you know, you're not very good at
55:08
answering the space questions. Moms much better at answering
55:11
the space questions. Like yes, this is.
55:13
High school mathematics so because needing.
55:16
Help with homework and you're like.
55:17
Man, I know I knew how to do this at one time, but my 9th
55:21
grader probably knows it better than I do now.
55:24
NIST isn't. Going to like hearing this, but
55:25
I'm actually worried about like the middle school math.
55:28
I'm not even worried about the high school math.
55:29
Yeah. Yeah.
55:30
As long as you're number sequentially, that's probably
55:32
all that matters, right. All right, let's go ahead and
55:35
wrap it up for this episode. Thank you so much Ryan for
55:38
coming back Yes, my pleasure with us.
55:40
I know you're in demand. The NIST guy's here.
55:42
We got to go talk to him. The.
55:44
NIST, Yeah. So yeah, I'll have links in our
55:47
show notes for people connected to you on LinkedIn.
55:51
I'll put the most recent versions of publications out
55:54
there so people can check that out.
55:55
Fantastic. You can follow us on.
55:58
A lot of different things. Twitter X, whatever it's called
56:01
these days, YouTube, all kinds of stuff.
56:04
So visit idacpodcast.com. You'll see all of our links up
56:08
there. And yeah, like and subscribe,
56:10
share with others. I want to give a shout out to
56:12
Anthony, who walked up yesterday to us after my panel and says
56:15
for himself, So always great to to see and hear from people who,
56:19
you know, enjoy the show. You don't enjoy the show?
56:21
Come up and tell us what's wrong with it.
56:23
We're happy to take that. Yeah, Anthony's feedback was
56:26
really cool. So he's, you know, he said he
56:29
really likes how we asked people how did you get into identity.
56:32
His story was that he was an identity for a couple years, and
56:37
then when he went to change jobs, he realized, oh, I was in
56:40
my identity. So now I'm going to, and now I'm
56:43
going to apply for identity jobs.
56:46
Yeah. It was very cool.
56:47
So all right, let's go ahead and leave it there for this week.
56:50
Thanks everyone for watching and or listening and we'll talk with
56:53
y'all in the next one. You've been listening to
56:57
Identity at the Center. We hope you've enjoyed the show.
57:01
Make sure to like, rate and review, and we'll be back soon.
57:06
But in the meantime, hit the website at
57:08
identity@thecenter.com. See you next time on Identity at
57:14
the Center.