Latest / Identity at the Center / #271 - Identity Management Day 2024 with Jeff Reich of the IDSA

Transcript

#271 - Identity Management Day 2024 with Jeff Reich of the IDSA · Identity at the Center

0:05
Welcome to the Identity at the Center podcast.
0:08
I'm Jeff and that's Jim. Hey, Jim.
0:11
Hey, Jeff, I was thinking that today is April Fools and I was
0:16
not sure what kind of joke we could play on our listeners.
0:19
What if we use some artificial intelligence to open up the show
0:23
today and see if anyone notices? That's an interesting idea.
0:28
Do you think we could get away with that?
0:31
Well, I do all the editing and I am pretty sure I can make AI
0:35
voices that sound just like. Us.
0:38
OK, let's see what you come up with.
0:40
OK, on the count of three and here goes nothing 123 and April
0:48
Fools. Do you think they bought it?
0:51
I hope not, this was a terrible idea.
0:54
Let's turn it back over to the real Jim and Jeff.
0:57
Happy April Fools to all of our listeners around the world.
1:16
This is identity at the center. If it has anything to do with
1:21
IAM, this is the go to podcast now your hosts Jim McDonald and
1:29
Jeff Stedman. Welcome to the Identity at the
1:33
Center podcast. I'm Jeff and that's Jim.
1:35
Hey, Jim. Hey, Jeff, how are you?
1:37
Not so bad yourself. Doing good.
1:39
So my topic for this week is going to be that I received an
1:44
e-mail from one of my banks. I'm not going to name and shame
1:49
because I'm going to pick on this e-mail now.
1:52
So the e-mail was entitled Essential Tips for Stronger
1:58
Passwords and I'm going to go over the tips.
2:01
Unique and complex passwords go long, avoid the obvious.
2:06
No repeats. Keep it secret and regular
2:09
updates which was change your password at least every 90 days.
2:14
The final recommendation was add an extra layer of security like
2:19
multi factor authentication and help ensure it's really you
2:22
signing in. I'll give you my personal
2:25
opinion. One I think it's it's good that
2:27
they're doing something but I think this is lackluster.
2:30
I think what they ought to be doing is telling people like if
2:33
you haven't enabled multi factor authentication you are putting
2:39
yourself at risk. That's probably the nicest way I
2:41
could put it. I mean as if they're making
2:44
multi factor authentication optional to access a bank
2:48
account, they should at least let people know if they're going
2:51
to send out an e-mail like this that that's the the right route
2:56
to go. Really what they should be doing
2:58
is passkeys or something much stronger and and easier for
3:02
people to interact with. But anyway, those are my
3:05
thoughts. What do you think?
3:06
I agree it's good that they're doing something.
3:09
I don't take as hard of a stance on it only because messages like
3:13
that to a broad public audience. I hate to say it, but I have to
3:17
be kind of dumbed down to the lowest common denominator and
3:20
not everybody understands. Still, even MFAI agree with you
3:24
like you should have a buffet. You should be doing all those
3:26
things. Those are all good tips.
3:27
I I don't necessarily agree with changing the password every nine
3:29
days, but hey, if that's if that's the policy, that's the
3:32
policy. But I think we have to take into
3:34
account the human element here is you've got a lot of people
3:37
and not everyone still to this day understands or can use multi
3:43
factor prompts the way that they've been maybe implemented.
3:46
Some MFA prompts are easier than others and maybe that is just
3:49
something to think about. If you are a bank or other
3:52
institution, what are the MFA methodologies that will be
3:56
easiest for your customers to adopt?
3:59
You know it. People won't do it until there's
4:01
an incentive to do it. And unfortunately, getting
4:04
hacked, as it seems like every day somebody's getting hacked
4:07
for something doesn't seem to be doing the trick.
4:10
You know, if I was to take a a little harder stance on it, hey,
4:14
because you're have less security in your account, we're
4:16
going to have to charge you an extra $0.50 a week until you
4:21
enable MFA. I'll bet you'd get a lot more
4:23
uptick in enrollment that way to offset the extra security that
4:28
we're having to do because you're not taking basic things
4:31
into account. Yeah, yeah.
4:33
I mean the the motivation should be there, right?
4:36
Because I I guess what it boils down to is that people aren't
4:40
aware, but this is their money. This is their checking account.
4:44
If I can log in, someone could log in as me to my bank, then
4:48
they'd be able to transfer money out, right?
4:50
I mean that's the only security protection is authenticating.
4:55
So you would think that anyone who has money in a bank who's
4:59
doing online banking has the means by which they could do
5:02
multi factor authentication of some form and that they'd be so
5:08
motivated. Now one thing interesting, you
5:10
brought up kind of that stick approach, you'd also take a
5:13
carrot approach, which is you get a little bit better of an
5:17
incentive in terms of your interest rate or not having to
5:22
pay a monthly fee or something like that.
5:26
So that's an interesting, maybe your approach.
5:29
Yeah, I mean, I like the. I mean, the intent is good.
5:33
I just anytime we deal with the public, I think it's just a
5:37
difficult situation. There's gonna be, it's like
5:39
anything else, right? Some people are early adopters,
5:40
some aren't. Some people are totally clueless
5:42
and you'll never be able to help them.
5:44
So what do we do about those folks?
5:47
Well, I mean, look and every go buy a car without a seat belt
5:51
you hand to it. But you can cut the seat belt.
5:53
Out. It's one of those.
5:54
What's that? You could cut the seat belt out
5:56
or not even wear it. Yeah, you have to actually go
6:00
forward then and do something. You can't really not wear it.
6:04
I mean, What Car do you drive these days without a seat belt
6:08
that's not dinging at you the whole time?
6:10
Here, let me tell you about moving to the South and living
6:12
in North Carolina. And the terrible drivers that
6:15
I've witnessed, they literally like I've seen somebody do this
6:19
in a parking lot multiple times. So it's not like a one off
6:21
thing. I pull in and the guy, you know,
6:23
guys, girls, whoever, doesn't matter.
6:25
They get in and they put the seat belt behind them and they
6:28
click it in and they just sit back against it.
6:31
So it feels like to the car, hey, seat belt's connected but
6:35
they don't have, they have no protection whatsoever.
6:38
Security theater in the absolute worst possible way.
6:43
Yeah. Well, I guess we won't solve for
6:45
everyone then, yeah. But what we can do is we can go
6:49
to conferences this year. What do you think of that?
6:51
I like that idea. We're gonna be at several Do you
6:54
wanna start or should I? I think you start and then pass
6:56
to me when you when you start getting worn out, 'cause we got
6:59
quite the list here. We do, but that's good though.
7:02
We've we've partnered up with several conferences this year.
7:05
The first of which coming up calendar wise is Identiverse.
7:08
It's May 28th to the 31st. It's at the Aria Resort and
7:12
Casino in Las Vegas. Jim, you and I will both be
7:14
there. We hope to see lots of friendly
7:16
faces and hopefully lots of new faces and meet folks who are
7:20
listeners out there. To help with that, we've got a
7:22
discount code. You get 25% off if you use the
7:25
code IDV 2 four DASH IDAC 25. Don't worry, you don't need to
7:31
remember that, pause it or whatever.
7:33
We'll have a link in our show notes.
7:34
You can go to our website also it's right on our homepage and
7:37
people can use that code. Get 25% off Nice free, easy way
7:41
to show support for the show. So that's exciting and looking
7:44
forward to Identiversary. We'll be doing podcasty things
7:47
there and not sure what else. We'll be doing other things.
7:50
We're going to get a couple of events that we will make sure
7:54
the Identity Center episode or podcast is involved with kind of
8:00
sponsoring. So there'll be an opportunity to
8:02
meet folks if anyone's interested.
8:04
We don't have all the details yet.
8:06
If anyone's interested, link out to me or Jeff, contact us via
8:11
LinkedIn DMS and we'll be sure to let you know what we're doing
8:15
when we know. Yep.
8:17
Next up we've got European Identity and Cloud conference.
8:20
This is the folks put out there by Cooper and Nicole.
8:23
That's June 4th or the 7th in Berlin in Germany.
8:26
We will not be there. I hope to make it next year, but
8:29
we do have a code for this year as well.
8:31
EIC 24, IDAC 25 gets you 25% off.
8:35
Again, no need to remember that code.
8:37
We'll have it in our show notes. It's also on the homepage of our
8:39
website. You can go out there and have a
8:42
good time. We just had Martin Cooper on.
8:45
We'll have Martin Cooper on in the coming episode, I should
8:47
say. So you got to learn more about
8:49
that conference coming up, but another way to show support for
8:52
that. And then Jim, why don't you take
8:54
care of Identity Week? Yeah.
8:55
And one of the things I wanted to mention is that hopefully
8:58
these discount codes are helpful for everybody.
9:01
One of the things that you can do with the discount codes is
9:04
combine them with early bird pricing.
9:06
So if you're planning on attending, you can get the early
9:09
bird pricing and use the discount code on top of it
9:12
really can save your organization some money.
9:15
Or if you're obviously if you're paying for it out of your own
9:18
pocket, all the better that have the discount code.
9:21
So the third conference to talk about this, Identity Week, which
9:26
is done in three locations around the world, there's
9:30
Identity Week, Europe and Amsterdam.
9:32
That'll be June 11th and 12th, Identity Week America which will
9:36
be in DC September 11th through 12th.
9:39
And that's the one that Jeff and I will be at and hopefully
9:43
participating in some of the sessions and podcasting and be a
9:47
great opportunity for folks who are able to make that conference
9:50
to just come over shake hands and we'll all the conferences
9:55
that we attend will always have identity to center stickers.
9:58
So if you if you want a sticker, and they're great stickers by
10:01
the way, just come to they're the best stickers.
10:06
We had the best stickers. I was waiting for it, 'cause I
10:08
was, I didn't want to do it. And it was like, there's a
10:10
there's a joke there, but go ahead.
10:12
Yeah. And then Identity Week Asia is
10:15
in Singapore, October 22nd through the 23rd.
10:19
We have a discount code of IDAC 30, that's IDAC 30 gets you 30%
10:24
off for any or all of those conference instances.
10:30
Yeah, all around the world. So it's kind of cool, right?
10:32
The code works everywhere. Yeah.
10:34
Hey, one of these days, maybe we'll go to all three of them.
10:37
To get like the the hat trick. Yeah, the any week hat trick.
10:39
That's something we should probably talk with that group
10:40
about. Some sort of incentive to go to
10:43
do all three and get people out. But who knows that?
10:45
'D be super cool. Oh, we could do like a cruise
10:48
like you do like a celebrity cruise we could.
10:50
We could book a very, very small rowboat and do an identity at
10:54
the center listener excursion to all three locations.
10:58
I definitely would be up for that Identity Week floater.
11:03
Yes, Pool noodoo, something like that.
11:07
Yeah, I'm up for it. Before any of that happens
11:10
though, we've got a momentous day coming up.
11:12
One of my favorite days of the year, something we've been
11:14
celebrating now for a couple of years, few years more than that.
11:17
I think now Identity Management Day, It's coming up, it's April
11:20
9th and we're gonna welcome back Jeff Rich.
11:23
He's the executive Director at the Identity Define Security
11:27
Alliance and an all around good guy as we were chatting before
11:30
the show. Welcome back to the show, Jeff.
11:32
Thank you very much, Jim and Jeff, it's great to be back with
11:35
you. And by the way, you do have you
11:37
do have good stickers, I have to say.
11:39
Jim is very proud of the stickers and they they are a
11:42
quality sticker. Here's a little fun fact for me
11:44
though is when I travel with them, TSA always thinks it's a
11:49
gel the way that they're like, I don't know, the adhesive or
11:52
something. So I'm always getting stopped at
11:54
TSA and it's like, yes, it's the stickers.
11:57
Here you go. I was like, Yep, that's it.
11:58
OK, thanks George. See ya.
12:00
Yes, I'm on a first name basis with the Asheville TSA.
12:03
Just give them. Just give them one.
12:05
Yeah, Here you go. Right.
12:07
So we're gonna talk about Identity Management Day in a
12:11
little bit, But you were with us last year around the same time
12:14
for the same thing. And then we actually talked to
12:15
you. Actually, I got to talk to you
12:17
because Jim wasn't there at Identity Week America just a few
12:20
months back. So that was episodes 206234.
12:23
It's not your first time here. People want to learn your origin
12:26
story. Go back and listen to episode
12:27
#206. But for a real quick you know
12:31
what is the IDSA and what's new since the last time we chatted?
12:35
So IDSA, the Identified Security Alliance exists to raise the
12:40
level of awareness for identity security and identity security
12:45
and I'll be happy to explain the difference between 12 three if
12:47
you like. We do that really targeted
12:49
towards starting with identity providers and identity vendors
12:54
and then going down a level to all the organizations that use
12:57
those tools and services to manage identities either for
13:01
their employees or their partners or their vendors or
13:04
their customers and consumers. And then it goes down to the
13:08
real bottom line benefit ends up being the consumer because even
13:12
though there are silicon based identities and we can have a
13:14
discussion about that. A lot of identity centric
13:18
discussions focus on the carbon based unit that you look at in
13:21
the mirror every day and that's where the true benefit for
13:24
identity security should be. So we've got IDM day coming up.
13:27
I know there's a couple other things that are kind of, I don't
13:30
know, put pins in the calendar for what else has got, have you
13:34
guys got brewed up for the rest of this year?
13:35
So you haven't heard the news because you know, we had
13:37
Identity Management Day last year and it was such a success.
13:41
We did a survey and realized that the entire problem of
13:43
identity security has been solved.
13:45
So we canceled the conference. This year.
13:47
Oh, congratulations. Thank you.
13:49
Thank you. It's, it's.
13:50
We feel very accomplished. This is kind of like the
13:53
password where we celebrated, I think last year.
13:55
We killed the password and everybody's on passkeys.
13:58
Not quite yet, I don't think, right.
13:59
I think there's still plenty to do.
14:00
Funny how these things always get announced on April 1st.
14:05
Someone picked up on that. Yes, that could be something to
14:09
do with why I announced the cancellation.
14:11
No. In fact, and I think everyone
14:13
knows, we weren't going to cancel it.
14:14
We haven't yet solved it. We are on the path, but we
14:17
haven't yet solved it. Now we're going to have a great
14:19
Identity Management Day this year.
14:21
There's there are some new components to it that I think
14:24
people are going to enjoy. Let me start off with the 1st
14:27
and then we can get into maybe questions you might have about
14:30
it. Last year we had almost 1200
14:33
participants representing 93 different countries around the
14:37
world and that gave us the idea that if that many people around
14:40
the world are that interested in identity management then why not
14:44
make it an around the world event.
14:46
So this year it's a 21 hour event and I still sometimes have
14:51
to regret making that decision, but it's because we're making it
14:55
run 21 hour events starting in Melbourne, Australia at midnight
14:58
UTC. If you go to the website, we'll
15:00
give you the address. You'll see how you can convert
15:03
that to your own time if you're not used to doing that.
15:05
If that'll run for about 6 hours, there'll be a quick
15:07
intermission. Then we'll go to Europe, Middle
15:10
East, and Asia coming out of Paris for about 5 hours.
15:14
Another quick break and then we end up with about 7 hours worth
15:18
of content coming out of the Americas region, and that will
15:23
tie it all up. That will end at about 9:00 PM
15:25
UTC on Tuesday. So it's a pretty almost entirely
15:29
inclusive April 9th. Mark your calendar block off.
15:33
Everything else be there. This kind of reminds me of like
15:36
a stream athon or like a telethon or something like that.
15:40
Are we going to see you like on stage?
15:42
Like, you know, hey, you know what Doing like the identity
15:44
dance at like 3:00 in the morning or something like that,
15:46
just to kill time. No, you might or just because
15:49
it's three in the morning that may be what I end up feeling
15:52
like doing the we we aren't raising money with it.
15:57
So there won't be a like a thermometer.
15:58
We have to watch that that's going up.
16:00
But we are looking forward to attending as we do have sponsors
16:04
and we have some great sessions. There's there's exhibit booth,
16:08
there's gamification. We can we can drill down into
16:11
all of that. But I do want to mention just a
16:13
a few organizations worth pointing out.
16:16
We have a lot of sponsors and I'm not going to list all of
16:18
them, but if you go to our website, you'll see them all
16:20
listed there. But but for since its beginning,
16:23
this is a fourth year in a row. We've done Identity Management
16:26
Day Co hosted by the National Cybersecurity Alliance.
16:29
They are the people behind Cybersecurity Awareness Month
16:32
every October. So you're familiar with them to
16:35
see something, say something there.
16:36
That's that group, great group to work with.
16:39
It's Co chaired by Saviant, one of our member organizations.
16:43
And our two around the world presenters is beginning to look
16:46
like a movie where you have all the different production
16:48
companies that show up in the in the credits.
16:50
But our two around the world presenters are in Melbourne,
16:53
Australia, Identity XP and in Paris it's a secure identity
16:57
alliance and we're actually doing some additional work
17:01
through a memorandum of understanding with Secure
17:04
Identity Alliance or SIA as well.
17:05
We can talk about that. So there's there is a lot going
17:08
on in addition to a great looking conference day.
17:12
Yeah. Say the last time we chatted,
17:13
let's start with Security Identity Alliance, because when
17:16
we were at Identity Week, I think that was sort of the
17:18
announcement of that coming out. So it's been a few months now.
17:21
How are things going with the Security Identity Alliance in
17:24
Europe? Things are going very well.
17:26
You know we are taking two organizations that are both.
17:30
We're both identity centric. IDSA tends to focus more on
17:35
having more commercial and and applications that are going to
17:40
be commercial and may be directed towards consumer.
17:42
SIA focuses a little more on working with some governments
17:46
and standards organizations. Now the reason we ended up
17:49
signing the member for a memorandum of understanding say
17:52
that three times fast is that it gives us a complementary set of
17:56
what we're each looking for. So as an example, one thing we
17:59
worked on, we each had working groups coming up with potential
18:03
solutions not to sell but to influence on know your customer
18:07
or Kayam depending on which side of the pond you're on.
18:10
We merge those two groups. So they are working together now
18:13
to come up with common deliverables and the first is
18:16
going to be delivered at Identity Management Day in the
18:19
EMEA segment. So it's going to be you know
18:21
have about halfway through that that 21 hour event and in that
18:27
we're going to talk about an outline of what we've done, what
18:30
the state looks like right now and where we think things are
18:33
going to be going in the next 6 to 12 months.
18:35
As an example, there some things to look for.
18:38
And by the way if you can't get up at 3:00 AM your time to see
18:42
this that particular session, all the sessions are going to be
18:45
recorded and they're going to be available to you.
18:47
So feel free to register anyway and you'll get recording
18:49
information. But one thing we'll be talking
18:52
about there is right now, as an example, you can use your US
18:57
based passport and very likely get into any country in the EU.
19:00
You don't unless you have a criminal record or something.
19:02
And I don't know your background, so I'm not going to
19:04
make any assumption. What I do on my own time is my
19:06
own business, Jeff. Exactly so.
19:10
But yeah, you can use your passport to get into another,
19:13
another country that accepts because the two countries signed
19:17
a treaty that said we will each meet the minimum criteria to say
19:20
we know whether we authenticated this individual.
19:23
And here's how you can tell it's our passport.
19:25
Well, that's going to start happening in the digital world.
19:28
It's often called a digital wallet if there are other names
19:31
for it as well. And I you're going to see, I
19:34
think within the next year, especially since EU has put out
19:37
some early legislation around this requiring it.
19:41
You're going to see influence coming from our organization to
19:43
say maybe this is what it should look like or maybe this is
19:46
criteria and this is how we should be able to interoperate.
19:49
And that's a word that that's my word for this year and just not
19:52
mine only. But interoperability, identity,
19:55
interoperability is the key for what we're going to have to do
19:58
going forward, forward or we're going to drown in identity.
20:00
Sprawl. And that makes sense.
20:01
I think there's been a lot of work been done to try to develop
20:05
standards so that interoperability exists.
20:09
There's other things that you guys work on as well at the idea
20:11
of, say you've got the Digital Identity Security report or the
20:13
trends in Digital Identity security report.
20:16
I'm expecting to see that probably sometime later this
20:18
year as well. What's the timing for that?
20:20
And I guess for people who aren't familiar with what with
20:22
what that is, what is it? So the trends in digital
20:26
identity security, this again, it's the 4th edition of this and
20:31
this is a research survey that we do through a third party
20:36
called dimensional research. So we never see who's getting
20:39
the questions and who's answering them.
20:41
So we have that level of abstraction, which is good.
20:44
They manage that for us and we have some questions that are
20:47
core. They get asked every year, such
20:49
as what we've been asking is have you encountered an identity
20:53
breach or similar incident in the past year?
20:58
To be completely frank, this may be the last year we asked that
21:02
because I think we're going to probably hit 100% this year on
21:05
responses. And once you hit 100%, there's
21:07
no more trends to follow. So let's see where where we go
21:11
with that. But there's others that really
21:14
dive deeper and some things were changing.
21:16
We're dropping some questions that really you know are are now
21:19
kind of going to pass like just finishing one that might.
21:22
We're talking now about how does AI influence how you receive
21:26
identity and how you manage identity.
21:29
And we're we've reached a point where I think every organization
21:32
has to recognize that they are going to counter AI when it
21:35
comes to identity, whether they like it or not.
21:38
And it doesn't have to be evil, but we're we're going to see
21:40
where do people stand, what do your budget look like for that.
21:42
So that report, it's free again, just like everything we do with
21:47
a couple exceptions is free. We are a nonprofit and that's
21:50
why we are a nonprofit. You can go to our website,
21:54
idsalliance.org and download any of the previous reports.
21:57
This report, to answer your question I didn't forget should
22:01
will be released at Identiverse on Tuesday, which I believe is
22:05
May 28th. In fact, our session to do that
22:07
is at 1:00 PM in Las Vegas. So there'll be a press release
22:11
that day and you'll be able to download the report that day as
22:14
well. I I I think we may have
22:16
snippets. We may be able to tease out a
22:18
bit a week or two before, but that's when you're going to see
22:21
the report. I like that report because you
22:23
mentioned snippets and I think I'm always looking for things to
22:26
help make the case for better identity and better identity
22:30
security. If there are two different
22:31
things like that, let's get back to Identity Management Day,
22:34
because I think I want to help Dr. Awareness, right?
22:37
That's why we're doing this episode.
22:38
This is why I've been supporter supporters of it for for several
22:41
years now since it began. Who is this day for?
22:45
Let me start broadly then we can drill down a bit.
22:47
Identity management day is for identity managers.
22:52
I think that one makes sense, All right.
22:53
But also you know anyone that's going to use either IT decision
22:59
makers because now you can't do IT without identifying who's
23:03
doing what 1st and specifically more than anything else we do
23:07
with throughout the year, the general public to see what's
23:10
going on behind the scenes. You know that the three of us
23:13
talked briefly about the identity echo chamber or the
23:18
identity bubble. And it's safe to say that at
23:20
least the three of us here probably live and work within
23:23
that bubble. Occasionally we may step out,
23:25
but that's pretty much where we are and we don't always we we
23:28
sometimes can lose sight of what's it like for everyone
23:32
outside that echo chamber or bubble and what's it mean to
23:34
them for identity. You know, the example you used
23:39
earlier, Jim, with the, you know, a suggestion of MFA as
23:42
opposed to requiring MFA to people outside the bubble, MFA
23:47
is just a friction point that they'd rather avoid.
23:49
In many cases they may not see the incentive.
23:52
So we want to be able to not only listen to what they're
23:55
doing but have them see what is driving that sort of activity.
23:58
You know I want to mention something and and feel free.
24:01
I know and post you could edit this out if you want but I came
24:05
across something you may have heard of.
24:06
I call it digital mugging. I don't know if you've seen this
24:10
and I'm coining that term. If no one else has, where the
24:14
there are gangs that target usually what appeared to be, you
24:18
know, not wealthy but at least upper middle class men coming
24:22
out of bars. They don't only accost, they
24:24
attack them and in one way or another get them unconscious
24:27
whether it's gas or not concern. I'm not going to go through
24:30
everything they do because this is not a here's how to rob
24:33
Bunny. Hey, what you do on your own
24:34
time, Jeff, is your business? Fair enough.
24:36
Yeah. Thank you.
24:37
Thank you. But what they do is keep them
24:41
intact, but but they're unconscious.
24:42
They take their phones, they use the face to unlock the phone and
24:47
then either Venmo money to themselves or, you know, or
24:50
Apple Pay, whatever else they're going to do or or direct bank
24:53
transfer and steal money and then just leave the people.
24:56
And yeah, as safe as you thought was, hey, biometrics are great,
25:00
right? Yeah, they are.
25:01
But sometimes we got away from MFA.
25:03
We're back to single factor. Sometimes when it's only a phase
25:05
that doesn't. So it's not solved.
25:09
Yeah, that was April Fool's joke.
25:11
We are far from solving identity.
25:14
You know I'm going to talk about one session in the in the
25:17
conference as well since we were talked about this there.
25:19
There's one session that the National Cybersecurity Alliance
25:22
actually is going to be presenting that talks about how
25:24
people love their password notebooks.
25:26
And that's a concept for those of the bubble that that seems
25:29
it's an athlete. It's like how could you possibly
25:32
have a notebook where you write down your passwords, right.
25:34
Well people do and and all and they did research on this.
25:38
A lot of people still do that and like it and think that's the
25:41
right way to do it. So that'll be a really good
25:44
session to hear what's behind that.
25:46
And then from that we can start determining what can we do to
25:49
start getting people maybe away from having to write down their
25:52
passwords in a? Book.
25:54
I think it's good to think about those types of folks, because
25:57
they're real people too. I hate to say it right is we
26:01
have to design things for all walks, ages, religions,
26:06
ethnicities, regions, whatever it may be, right?
26:08
That kind of thing. What are some of the other
26:11
content things that we can expect from Identity Manager
26:14
day? You mentioned it's 21 hours.
26:17
It starts, I guess technically the night before US time, right?
26:21
Walk me through how this is going to work from like a time
26:24
zone perspective. So it'll start at around 8:00 PM
26:27
Eastern on Monday evening and in Melbourne actually that's the
26:32
only portion of this that's a hybrid event.
26:34
They're going to have some people in an in a venue and
26:37
they're going to be streaming it as well.
26:39
So the kickoff starts there. I'll be there for that just
26:42
because it is the official kickoff.
26:43
And then they're going with their session.
26:45
They have a number of good local speakers some coming from
26:48
vendors and and some coming from whether you want to call them
26:52
users or victims depending on what stories are telling about
26:55
identity and and a lot of people think that the stories are the
26:59
same everywhere, but they're not.
27:01
Issues that exist in Australia are going to be some we haven't
27:04
seen in the US yet and vice versa.
27:06
So it it's good to be able to hear some of that plus you know
27:10
what sort of what sort of processes work with in the
27:14
government constraints of say ocean, you know Oceana countries
27:19
that are going to look at privacy very differently than
27:21
the US does. So there's something to keep in
27:24
mind as we move to EMEA. You're going to hear a little
27:26
more, especially from the SIA about one, you're going to hear
27:32
a report on the common working groups I talked about that came
27:34
up with that's coming up with the KYC recommendations and and
27:39
foundation. You're also going to hear from.
27:41
And I'm not going to go through every single one, but you're
27:43
going to hear one session that's going to talk about an
27:45
organization that we are involved with along with SIA and
27:49
that's called CD Hub, which really deals with sustainable,
27:53
interoperable digital identities.
27:56
Now, sustainable does not necessarily mean that you
27:59
recycle your IDs and it's all green, that's that's, although
28:03
that might not be a bad idea, but it really focuses on what
28:07
can we do to have an identity that's sustainable for you so
28:12
that your identity now is, is the same identity you're going
28:15
to have in 10 years. Right now, you can't necessarily
28:19
have any level of assurance that's going to be true.
28:21
Hence some people are going to keep password notebooks because
28:25
there's so many different identity and all it all fits
28:27
together. So you're going to see a really
28:28
good presentation on what what, what sort of work's happening
28:31
there and what we want to do for that interoperability and and
28:35
and maybe digital wallet standards that could occur
28:38
across most countries. And of course, we're going to
28:41
have an effort at some point to see if we can't get the US to
28:44
start thinking about that too. But that's yet another complete
28:46
effort. And then and that'll start at
28:50
about 3 AMI failed to mention Eastern in in EMEA.
28:55
And then in the US it'll start at around 10:00 AM Eastern.
29:00
We're we are going to actually, we have an Expo with sponsors
29:03
and booths because it's AUS and and you're going to have live
29:06
streaming. It's going to be almost as if
29:09
you were in a live conference. The only thing you're going to
29:11
miss are the travel and and hotel cost and the smells.
29:15
But other than that it's going to be just like you're in a
29:16
conference. You can go up to a booth and
29:18
there'll be someone there. You'll see them.
29:20
You can interact with them and ask them a question, or you can
29:23
download a document, watch a video, and what we do to give
29:27
you some incentive, do all that. We have gamification.
29:30
Just like if you were at an in person conference, you might
29:33
have one of those bingo cards and have every vendor stamp it
29:36
so that you can put it in for a raffle.
29:38
Prizes at the end. Well, we do something similar,
29:40
but we track you. So just so we're watching
29:43
everything you do, we're going to track every time you go to a
29:47
session or every time you visit a booth or every time you
29:50
interact with someone and you'll get points for that and we'll
29:53
show you what the points are. And at the end of the Americas
29:56
region sessions, which will happen at around 4:00 PM
30:01
Eastern, we will then tally all that up and have winners, some
30:05
for individual sponsors and some for general prizes, just like we
30:09
did last year. And that that was a that was
30:12
good. People really like that.
30:13
And I I think it's a good incentive to get through.
30:16
I failed to mention and he wouldn't like it if I didn't
30:19
finish this without talking about him.
30:22
Our keynote speaker is Caleb Sema, someone I've known for a
30:25
while. He previously was the CSO at
30:28
Robin Hood, had a leadership role at Capital One, had a
30:32
couple start-ups. Currently he chairs the AI group
30:37
at the Cloud Security Alliance and Caleb.
30:40
What I like about what he did, he took some time over the past
30:44
year and just stopped doing most of the things and dug into AI.
30:48
You know what's going on with AI or what are all the buzzwords
30:51
mean? How do I really make it work?
30:53
And he's going to talk about AI and the effect of identity and
30:57
vice versa during his keynote at the beginning of the America
31:00
session. And I'm not.
31:02
I'm looking forward to all of it, but I'm really looking
31:04
forward to that session. I'm looking at your website and
31:07
it's identitymanagementday.org and I'm kind of scrolling
31:10
through here and looking at different parts of it.
31:12
You got a nice little countdown of when this is gonna take
31:15
place, and then I'm looking at different kind of conference
31:18
sponsors and things like that. You've got some big names here
31:20
and names that you know were probably pretty well recognized
31:25
amongst people who are in the Identity space and others that
31:29
might be a little bit more up and coming and some that we know
31:32
here on the Identity at the Center podcast and stuff like
31:34
that, which is really cool I guess.
31:36
What are, I guess, are these the folks that are in that kind of
31:39
virtual conference hall type thing that you were talking
31:42
about? Are they doing other things?
31:43
Yeah, if you look at the conference and sponsorship tab,
31:46
you'll see that, you know in addition to saving it as a Co
31:49
chair, there's Cyber Ark and Sail Point, our two platinum
31:52
sponsors and then we have a number of gold sponsors and
31:55
silver and bronze sponsors as well.
31:57
And we're still adding a couple of those.
31:59
Actually, I think we got one coming in today and each one of
32:02
those are going to have an exhibit booth.
32:04
So when you get to the conference, there will be a
32:08
lobby and a carousel with different logos going around.
32:12
And you can just go to the Expo hall and you'll see all the
32:16
booths. And they're going to have not
32:18
only just their logos but a social card that really they're
32:21
to attract you. Hey come see me first and and
32:24
you click on it and there should be someone in there just you
32:28
know and they may be even talking to someone else but
32:31
you're going to see them. You can engage them.
32:34
Ask any question you have. You say hey I went to the
32:36
session for your speaker what does this feature do can you
32:39
show it to me. They can do demos there.
32:41
They can get that you can download white papers you can
32:44
watch videos they have set up and you can have in addition to
32:47
that you can schedule time. There is a a a meeting scheduler
32:51
button you click that and you say I want to talk to someone
32:53
about maybe possibly buying this.
32:55
You will definitely get your attention if they if you do that
32:58
and I'll just click, I want to meet with you at and you'll see
33:01
the open times 2:00 PM today and it'll convert to local time for
33:05
you so you don't have to worry about that and and then you'll
33:07
have a meeting with him as well. So all of that happens out of
33:10
the Expo booth. In some ways it's almost better
33:13
than an in person booth. Yeah, you don't have to like
33:16
roll your eyes or look board or hide your badge or flip it or
33:19
anything like that. It sounds like such a cool
33:21
event. And like I said the the the this
33:23
podcast has been supporting it for since its inception.
33:26
So I think this is what its fourth year, am I right?
33:29
Yeah, that's correct. It's the fourth year and thank
33:31
you for your support by the way, throughout both of you.
33:33
Hey, anything we can do to promote identity?
33:36
That's what we're all about. And I guess I, I feel like
33:39
you've covered like everything that there is to know about, at
33:42
least for now, Identity manage today, it's April 9th,
33:46
identitymanagementday.org. I want to get your thoughts on
33:50
stuff that's going on in the world.
33:52
And I know Jim has like a list of things to kind of put
33:54
together here. Are we OK?
33:56
Can we move to that? Are you ready for that, Jim?
33:58
Or there's anything else you want to get out, Jeff?
34:00
I think it's time for Stump Jeff.
34:02
All right, Stump the other Jeff or Stump Both.
34:04
Jeffs. Who knows?
34:05
Yeah, there you go. Well, yeah, I would love to get
34:08
some feedback from Let's have a round table on these.
34:10
So I'm going to hit you with a few topics and let's just chat
34:14
about them. They kind of think these things
34:16
are going to have an impact on Identity Day.
34:20
So the first one is artificial intelligence.
34:23
Can't talk about IEM and not talk about artificial
34:27
intelligence, right? Absolutely.
34:31
There's a reason that our keynote topic is AI and
34:34
identity. So I agree with you and and
34:37
let's talk about what this might really mean.
34:40
I mean, there's the obvious that most people might be aware of
34:43
and that's deepfakes, right? I know that there is a a
34:47
movement by some people to say deepfakes should be illegal.
34:51
I have, even if that were to really, really pass, I have no
34:54
idea how you could enforce that or if it even makes sense.
34:59
It's going to be there and in some cases it makes sense to
35:03
have and I know you talk about another guest you have coming on
35:06
Martin. This is a term I heard him use.
35:08
I'm not sure if he coined it or not but a digital double and and
35:11
since I'm more of a sci-fi fan I I said well you're talking about
35:14
a clone but he said no it's a digital double and if you know
35:17
Martin he he will stand on that as it that's that's the
35:20
definition and there are time for actually that can be
35:23
beneficial because if you have routine tasks that need to be
35:26
accomplished and and an AI response can do it but it needs
35:30
an interaction then actually a digital double that's it's a
35:34
wonderful application. You can also use AI to offer
35:39
predictive analysis on how you manage identities.
35:42
Yeah, I mentioned earlier the term identity sprawl because
35:45
over time you get. I have and it grew by 1:00
35:49
today. I currently have 898 unique
35:53
identifying accounts that I keep in my credential manager.
35:57
That's stupid. If you have that many and you're
35:59
not in this industry, get a Life.
36:03
But Identities for all There and Access for All.
36:06
Now the with that's a really problem.
36:08
A really a problem within a corporation.
36:11
I did some consulting for a while and whenever I would be
36:14
brought in for a consulting gig, there were two questions I would
36:16
ask. The first one was when did the
36:18
incident happen? And usually the response is, who
36:20
told you? I said, yeah, you wouldn't have
36:22
hired me if you didn't have one. So let's talk about what it was.
36:24
So we get that out of the way. And then my next question is,
36:27
can you introduce me to the individual that's worked here
36:29
the longest? And when they meet that person,
36:31
chances are they have access to everything in the company.
36:34
Because over time, if they've been there, say, 25 years,
36:37
they've had a variety of different jobs.
36:40
And even if people are good at it now, in the past certainly
36:44
you had access to all of these things and you move on to a new
36:47
job and you get access to all the new things.
36:49
And over time you have access to everything that is at at best
36:54
difficult and and mundane to maintain.
36:56
And realistically it it doesn't get done very well.
37:00
A predictive analysis could do two things.
37:02
It could start keeping better control and giving you either
37:06
whether it's automatic or presenting you with options to
37:09
manage that. And more importantly, getting us
37:12
to just in time access so that through predictive analysis,
37:15
it's going to know that every Thursday, you know Jeff does
37:20
this action. So it should just know that it's
37:23
going to make sure you have access on Thursday morning and
37:26
and from Thursday afternoon through the next Thursday
37:28
morning. You don't have access and you
37:30
shouldn't have to write a rule. AI should be able to do that so.
37:33
Yeah, that makes sense. I think there's a lot of
37:35
goodness there. Jeff Stedman, I mean we talk
37:38
about AI and what its impact is going to be on this industry all
37:41
the time. Are you?
37:44
Are your thoughts evolving as we're having some of these
37:47
really insightful guests? I mean, yes, like every time I
37:51
hear a viewpoint, I take that in into my Borg mind and
37:55
consolidate it somehow. You know, I'm still bullish on
37:58
it. I still see the benefits for it.
38:01
I still see the drawbacks for it.
38:03
You know, you and I have experimented with AI Voices for
38:06
example, for this podcast hasn't gone so great.
38:09
Like I think the technology isn't quite there, but the idea
38:12
of being able to put together a reasonable duplicate or digital
38:17
twin or clone, whatever word you want to use is within reach.
38:21
And getting more and more within reach of more people and the
38:26
quality of that clone or twin or whatever you want to call it is
38:30
also getting significantly better.
38:32
I mean just look at the impact on spam emails and things that
38:38
used to be phishing. You could, you used to be able
38:40
to very clearly identify those. It was poorly written in
38:44
whatever local language it was being sent in and, you know,
38:48
just didn't make sense. Now you know you've got tools
38:52
that will translate and make things believable and stuff like
38:55
that. So there's certainly drawbacks
38:56
for it. I think it's gonna be a big
38:58
impact obviously for everybody. But I I I kind of like the idea
39:02
of of seeing it more integrated into technologies.
39:07
So things like, you know Clippy on steroids, if you remember
39:11
that from the Microsoft days, you know now they've got
39:13
Copilot, right? Natural language things.
39:16
Show me this data in a way where I don't have to know how to join
39:20
sequel tables or write statements in Python, right?
39:23
To pull information, stuff like that.
39:24
I think there's an opportunity here for vendors to take
39:27
advantage of large language models to make their products
39:30
easier to use. If they're easier to use, your
39:35
customers are going to get more value out of it, get better
39:39
insights, maybe it's faster to configure whatever it may be.
39:41
So I'm, I'm kind of all over the place with it, but I'm still
39:45
bullish on it with reasonable caution and safeguards around
39:48
it. Yeah, I feel like I'm being a
39:51
curmudgeon by saying this, but I kind of feel like, OK, the term
39:56
AI might get tossed around like the terms Euro Trust.
40:01
Everything's Euro Trust. And hey, we've got AI on our
40:04
product now. Because when I think of like
40:06
what the most, the best practical use of AI has been
40:10
that I've found. Is with the GPS where it starts
40:13
to tell you go this way instead of that way.
40:17
It's going to save you time based on all this data.
40:20
There's large amounts of data that I've collected almost near
40:24
real time and I've been able to update your route based on that.
40:28
But wait a second, that came out like 10-15 years ago, right?
40:32
So is that AI? But it sometimes when I hear
40:36
about like, oh, what does your AI do?
40:38
It's like, well, we can, we can suggest that since a whole bunch
40:42
of other people have this role, then you should have that role
40:45
too. I'm like, that doesn't sound
40:48
that whiz bang to me. I'm sorry.
40:50
So hey, somebody's got to be the naysayer.
40:54
I'll be the naysayer this time. Got so, so much for rapid fire.
41:00
But the next one that I've got for you, Jeff Rich, is you did
41:04
say identity security and identity security.
41:09
And I'll explain what the difference between those is.
41:12
So now's your time. Sure.
41:14
Thanks. And I this one I can do quickly.
41:16
Identity is The Who or what. I Simply put and we need to be
41:21
able to define what that means. So you can't just Willy nilly
41:24
say this is my identity. We have to have some.
41:26
We accept this as an identity. We don't accept that as an
41:29
identity. OK, so that's the first one,
41:31
that's identity. The next one is security.
41:33
And security really boils down to we have rules that say who or
41:38
what can get in and and do what to what resources subjects and
41:43
objects and and those rules should be enforced and followed.
41:46
That's security I and and and it's going to apply to identity
41:49
because you're not going to be able to do security without that
41:52
identity first. If you don't know who or what
41:54
then you can't allow or block or you'll block my default maybe.
41:58
And then identity security is I have my name, my Social Security
42:02
number, my healthcare history, anything else about me that I
42:07
want to protect. Because when that's leaked, it's
42:10
now one easier for someone to impersonate me.
42:13
Or more importantly now either there's some unique things that
42:16
I no longer have or there's things of value that I know no
42:19
longer have. So that's why I look at those
42:21
three as being separate. Yeah.
42:23
You know in the early days of identity management we talked
42:26
about or identity governance giving the right person the
42:31
right access at the right time. Then someone said no, it's the
42:35
right person or thing. Do you think things have
42:38
identities? Absolutely.
42:41
So what sort of phone do you have?
42:42
You don't think of a brand? Are you on an Apple iPhone?
42:45
OK. So, so you're beyond a flip
42:47
phone, right? Yes.
42:48
Yes, there is an identity in that phone and you associate
42:52
your virtual identity with the identity embedded on the chip in
42:58
that phone. And you do that because in fact
43:00
there's a security kernel in that chip specifically for that
43:04
reason. So that when you pick up the
43:06
phone and the camera sees your face, it knows it's you based on
43:10
the criteria you set up, correct.
43:12
Now when you sell that phone or trade it in or it's time for a
43:16
new one for you or you're going to give it to your nephew or
43:18
whatever, whatever else you're going to do with it.
43:19
Chances are, I I mean you're a security savvy guy, you're going
43:24
to disassociate your identity with the identity of that
43:28
silicon based chip in the phone. But that identity of the silicon
43:32
based chip remains and the next owner or user will then
43:36
associate themselves with it. So yes, I do believe that there
43:41
there is a what does exist. And there'll be times where I'm
43:46
going to say I'm going to use this phone to unlock a door and
43:50
it'll be the phone doing it, not me.
43:52
Interesting. Jeff, any follow up?
43:53
No, I I feel like the scene from old school where Will Ferrell's
43:59
character blacks out and gives like the great answer and James
44:01
Carville's got nothing to say. I agree with everything Jeff
44:04
said. Next.
44:06
Next. All right.
44:08
So next topic, there's a recent cyber attack in the healthcare
44:13
space that you were talking about prior to us hitting
44:16
record. I was wondering if maybe you
44:18
could share a little information about that because you you kind
44:22
of like pose it as like this could have a major impact on not
44:26
just this one company, but it could have an impact on the
44:30
industry. Yes, I believe that impact has
44:33
already started and some of us in the bubble see it and almost
44:37
no one else does. Some are.
44:39
Some individuals are getting but they don't know why.
44:41
So the organization has changed. Healthcare, it's owned by United
44:44
Healthcare. I'm saying that only because
44:46
that's the incident. I'm not picking on them because
44:49
I learned a long time ago if you pick on the company that has
44:51
been attacked, they're going to do it to you when you're
44:53
attacked and you will be. So that's how it goes.
44:56
But in any case they are a clearinghouse that works for
45:03
clearing pre authorizations for medical procedures and surgery,
45:08
for authorization for insurance companies, for coverage, for
45:11
authorization for billing so that the provider can get paid
45:16
and all that reconciliation. So they have all the patient
45:19
information, all the history and all the ties to financial for a
45:23
large portion of individuals in the US because it's not only
45:28
United Healthcare that uses them, a lot of other companies
45:31
use them. So as an example, let's say
45:33
you're a a physician with it's your own practice and you have
45:37
four people working in your office and you do procedure
45:40
specialist and you do procedures and all of a sudden you now
45:44
won't. You no longer can get insurance
45:46
reauthorization for the procedures.
45:48
You can no longer find out if, if and when it's going to
45:51
happen. And if you just performed a
45:53
procedure, you can't find out one if insurance is going to
45:56
cover it anymore because that does change or if you're going
45:59
to get paid. And if you're that small
46:01
provider and you go a month in that condition, which it looks
46:04
like it's going to happen, what happens to your business?
46:07
It's still a business. You may not have a business
46:09
anymore. So this has gotten the attention
46:12
of Congress and the White House and there is significant
46:17
discussion about offering financial support for
46:20
organizations that are affected you know with a big loss from
46:24
this. So if you look at that whole
46:26
downstream effect and just does it the arc of what we of what I
46:29
just described, this is one example where the government is
46:32
saying we have to provide financial assistance in order to
46:36
keep this industry going and Healthcare is a real important
46:40
one. It's important to me.
46:41
I I just had surgery a couple of months ago and I actually called
46:45
the hospital before to say give me an assurance that your
46:49
systems are going to be up and running when I have my surgery.
46:52
But take that whole arc of everything now and the financial
46:56
impact that's going to come from the government and how do we
46:59
address that I. Think it's really interesting.
47:02
I think we've already seen some of this play out a couple years
47:06
ago where it was I forget which what the name of the pipeline
47:09
was Colonial. I have the name of so many
47:12
pipelines floating around in my head these days that I can't
47:15
remember which one it was. But they had to underwent a
47:17
cyber attack and it started to address started to impact the
47:22
the the fuel supply chain. I know around me like a lot of
47:27
gas stations ran out of gas for a few days, but it was an eye
47:32
opener and it was like we need to identify these areas where
47:39
you know, 11 company gets breached or one thing happens
47:44
and then it affects the entire supply chain.
47:46
And it sounds like a lot like what you're talking about.
47:50
So I kind of feel like, you know just you have to throw some
47:55
money at the problem. But it doesn't have to be the
47:57
government throwing money at the problem.
47:59
I think it has to be that these companies have to do something
48:03
and if they don't do things that they need to do, then they have
48:07
to throw money at the problem, you know, anyway, that's my own
48:12
personal opinion. I think the the thing that you
48:16
said there that I really liked, I did want to just point to it
48:19
is that you know you did say the name but you kind of qualified
48:24
it as look, I'm not picking on these guys.
48:27
So I think Jeff and I always go the extra mile to make sure that
48:32
look let's not kick it, let's not kick them when they're down
48:35
because eventually my BS is down and it's just not the right
48:39
thing to do. So I wanted to to recognize that
48:43
you did that. Jeff, any comment on on
48:45
anything? I think Jeff, Jeff brings up a
48:48
really interesting point that I'm not sure gets enough air
48:51
time and it's those downstream effects.
48:54
A lot of these, you know, smaller providers that do go
48:58
from paycheck to paycheck essentially are are really
49:01
struggling right now because they couldn't get paid for X
49:04
number of days. And if you have a very tight
49:06
payroll, right that could be challenging.
49:09
And I wonder, and I don't know if this is the case or not, but
49:12
when you're game planning for disaster recovery scenarios or
49:16
doing table tops, do you think about these sorts of things and
49:20
what are the knock on effects that have come down not only of
49:23
getting your system back up and running, but what does it mean
49:25
for your customers, your suppliers, your vendors, you
49:29
know, etcetera. I think it's something to think
49:32
about. You know, I I hope that that was
49:34
kind of considered, but if it wasn't, hey, lesson learned,
49:37
Let's think about that. And if you haven't done it yet
49:39
for your organization, maybe it's time to think about that,
49:42
right. If you're responsible for paying
49:44
invoices and things like that, those are things that you
49:48
definitely want to make sure that you know, continue to
49:50
happen. Because if you get impacted that
49:53
way, maybe those vendors don't want to work with you anymore
49:56
and that could be pretty detrimental to your business.
49:59
Jeff, Rich, one last rapid fire question and we'll have to keep
50:04
it pretty tight is what do you think is the top trend for
50:10
identity tech firms either pick one technology or one trend that
50:15
you're seeing over and over again?
50:17
Well, I'll give you a tight answer and we need to see more
50:19
of it. Interoperability, you know,
50:21
every company is going to come up with, here's our new service,
50:24
here's a great new product. Look at this.
50:25
It's a whiz bang. Here's what happens
50:27
automatically. All of that's great, but if it's
50:29
in a silo, it's only great to a degree.
50:31
We have to get to interoperability and the smart
50:34
organizations are beginning to see that.
50:37
So Marvel word a year from now when when we're getting ready
50:41
for next year's Identity Management Day and we talk about
50:44
it. Let let's ask how far has indoor
50:46
operability come along? Since when it almost didn't
50:49
exist a year ago? Interoperability.
50:52
Easy for me to say. Jeff Sedmon, your turn.
50:56
What do I want to see or what do I think will happen?
50:58
I hate the term converged, but I keep saying this term come up of
51:02
converged platforms which I'm not necessarily sold on because
51:06
that sounds an awful like a suite to me.
51:09
And we've gotten away from sweets for the last couple of
51:12
decades because they turned into OK at everything, not even great
51:16
at some things. So I really don't like the idea
51:19
of converged, at least not in the historic definition, let's
51:24
put it that way. I think it's fine to have a
51:26
modular approach and I can license the parts and pieces
51:29
that I want. As long as those parts and
51:31
pieces are actually good at what they do, then sure, build a
51:36
better product. Then I'd be happy to make the
51:38
investment on a platform. But I don't want to be locked
51:40
into a platform that does IGA perfectly and sucks at Pam,
51:46
right? That doesn't do me any good.
51:47
I have to go out and now buy another Pam product.
51:50
So I I I'm not a fan of the idea of converged only because I
51:54
haven't seen a truly excellent one that's excellent at
51:58
everything in a way that makes sense for me as a customer.
52:01
Only license the parts that I need.
52:02
Don't make me pay for AI that I'm not going to use for five
52:04
years. That's a pet peeve of mine.
52:06
Don't make me pay for features that are in a product that are
52:10
great. I can't use it for two to three
52:11
years because I'm still taking identity requests via fax
52:14
machine in my organization, right?
52:17
Things like that. So that's that's the trend that
52:20
I keep seeing. Man, that's awesome.
52:21
I I totally agree with you on that.
52:24
I think the trend that or the most important development that
52:28
I think is already happening is already afoot and needs to get
52:33
better is monitoring. And specifically there's this
52:38
ITDR space, identity threat detection and response.
52:42
And to me it's all about understanding when you have
52:46
abnormal activity happening within your environment that's
52:50
at that level, layer seven of the OSI model, it's application,
52:55
it's identity level threats that are happening or can be detected
53:01
and responded to. To me, this is the only way for
53:06
some organizations when they have large decentralized models
53:09
and the technology footprint is evolving so quickly that they
53:14
can't keep up with you know the standard like provisioning and
53:20
access management and XY and Z. They have to lay layer and have
53:25
this ability to what's going on. And so I think to me this is,
53:30
you know, even if you do have a perfect system in place, you
53:33
still get a ton of benefit from monitoring.
53:36
If you don't have a perfect system in place, if you're
53:38
lagging behind and you can monitor, at least it's a
53:42
compensating control. So for me monitoring ITDR that
53:46
gets my vote. It's a pretty decent vote.
53:48
I think we want to write things up because Jeff needs to get a
53:52
whole bunch of sleep and get travel time so he can be well
53:55
prepared for his 21 hour Identity Management Day
53:58
telethon. Before we go, it is April Fool's
54:03
Day and I got to be honest, when you brought that thing up
54:05
earlier in the episode, it totally went over my head.
54:07
I wasn't even thinking about it. But today is April Fool's Day,
54:11
so we'll end in a later note. What is the best April Fool's
54:15
prank that you've seen, heard, or maybe pulled off Jeff?
54:20
We'll start with you and then I'll go to gym.
54:22
All right, in high school, taking a music instructor at
54:24
Volkswagen Beetle part piece by piece from the parking lot, and
54:28
then bringing it inside and reassembling it in his office.
54:31
He hated it, but it was great. That was when you could pick up
54:36
a car, you. Could you?
54:38
Every part of that car was could be lifted by an individual.
54:41
So piece by piece, into his Where?
54:44
Where did it go? In his office?
54:45
Into his office? OK.
54:46
And how did the place get back out?
54:48
We had to take it apart and because you can't drive out
54:52
through that you know, 36 inch door.
54:54
That's a pretty good one, Jim. What about yourself?
54:57
So this one that I pulled the year was 1997.
55:02
My first job and I worked in a small office and I was the only
55:07
one who knew how to do anything on the computer really.
55:11
And I decided on April 1st to play a prank on my boss.
55:17
So what I did was I went to his desktop, I took a screenshot of
55:22
the background, I flipped it over 180° and I turned that into
55:28
a screensaver. And so he comes back to his
55:31
computer and his, you know, his start button is at the top of
55:35
the screen over on the wrong side.
55:37
He's like, he calls me into his offices, like, what's going on?
55:41
I'm like, ah, it's easy to fix. And I went in there and I did a
55:43
few things and turned off the screen saver.
55:46
He was like, oh, that was weird. I finally did explain to him
55:52
like, yeah, April Fools. But yeah, he had no he.
55:56
He would. He had no clue what was going on
55:58
with this computer. It's getting harder.
56:01
What about you Jeff? I've done a few.
56:03
I, I, you know I feel like this is something that I used to do
56:06
all the time and I don't think I've done one in a while.
56:09
I I guess the one that I probably remember the best would
56:13
be when I was working at Walgreens.
56:15
So this is a very long time ago and I put out an e-mail to the
56:19
rest of my team. And I think at that point
56:21
there's probably like 15/20/25 people maybe that were on the
56:26
team that I'm leaning. And I put out an e-mail that
56:30
basically said, hey, here's what's going to happen.
56:32
We're going to have to come in this weekend.
56:35
We've got this project, we've got to, you know, basically set
56:38
up a 24 hour shift to crank out IDs because automation didn't
56:42
exist at that point. And you know, basically made it
56:46
sound like, oh, this is going to suck.
56:47
And I hate Jeff and why is he? Why?
56:50
Why is this happening to us and things like that?
56:53
And so I drafted it up and you know, I had it.
56:57
It was a good e-mail, let me just put it that way.
56:58
Like no AI was involved, but it was a well crafted e-mail and I
57:03
sent it out. And then just like, you know,
57:05
someone pulling the strings just sat back and watched and
57:08
listened and I heard sounds of disgust and like really?
57:14
And what and Jeff? And.
57:17
Things like that. And I let it go for maybe just,
57:22
you know, a few minutes, enough to kind of get it around and
57:25
then basically said, you know, now this is the April Fool's
57:28
joke. Well, I think it's funny that
57:30
all of our stories were at least 20 years ago, right?
57:34
It was all in our younger days. Because I think one of the
57:37
things that you learn as you get older is like people can enact
57:42
revenge on you, and that's what you don't want to happen.
57:45
So it's better just to leave people alone in this world.
57:49
And that's what I've been doing on April Fools for the last 20
57:53
years. Yeah, I haven't done anything in
57:54
a while. I love to have fun at work.
57:56
I think maybe at some point I will do something again, but
58:00
it's been a while. I think so.
58:02
Look, if I'm playing April Fools prank on on you, it means I like
58:06
you and I care about you. I'd be more concerned if I don't
58:10
give you any attention whatsoever.
58:13
Yeah, you might like me, but if you played the wrong April
58:16
Fool's prank, I might not like you so.
58:18
Did you catch? I know you probably don't even
58:20
listen to this podcast because we're here and but I do all the
58:23
editing and we had an episode recently where both of us were
58:27
struggling with our words. And if you listen to the
58:30
episode, there is definitely an April Fool's prank in there.
58:33
It wasn't an Easter egg. A little Easter egg, Yeah, for
58:36
for you to hear. And one of the times that you
58:38
and I were both struggling trying to get a word out.
58:43
Sounds fun, yeah. All right, let's go ahead and
58:45
leave it for for this week. Jeff, thank you so much for
58:49
being part of this and for hosting such a great event.
58:53
Definitely support Identity Management Day.
58:55
Want to get people out to the website?
58:56
identitymanagementday.org? It's April 9th or April 8th at
59:01
roughly 8:00 PM Eastern, depending on how you want to
59:04
look at it. Jeff, any final words of wisdom
59:06
for us before we let it go? Well, first of all, thank you
59:09
both very much. I as always, I've always enjoyed
59:12
your company. This is a great podcast.
59:14
Thank you for supporting Identity Management Day.
59:16
It's going to be a great event this year.
59:19
I think we have that we, we have our digital research survey
59:21
coming out in May. We have a work that's going to
59:24
go through CD Hub associated with Identity Week in September.
59:28
So it's going to be a great year for Identity.
59:30
Thank you. I love it.
59:32
And let's see, Jim, you and I, we're on the web,
59:35
idacpodcast.com. You'll find a link to all of our
59:38
episodes as well as all the discounts.
59:40
They just put them on the main page.
59:41
So if you hit our website and Scroll down, you'll see all the
59:44
different discount codes we've got for the different events.
59:46
And if you look up on the menu bar, there's also a link for
59:48
Identity Management Day. So you can use that to get to
59:50
identitymanagementday.org. We're also on Twitter X,
59:54
whatever it's called at IDAC podcasts, on Mastodon at IDAC
59:58
Podcast, at Infosec dot Exchange.
1:00:01
And like Jim said, if you have questions, comments, concerns,
1:00:03
you can hit us up on LinkedIn. Jim, final word for this week.
1:00:07
YouTube. YouTube yeah, we're trying to
1:00:09
grow on YouTube channel. So I think, you know I was
1:00:12
actually talking to our our new friend Ian.
1:00:14
Well, maybe not new, but we've conversed.
1:00:16
Finally met him face to face today.
1:00:18
Think on a on a call and he's actually been watching the
1:00:21
YouTube stuff. Which I'm glad Ian.
1:00:24
First of all, thank you for watching our really boring
1:00:27
YouTube videos because it's just.
1:00:28
Our Logan seeing right? Yeah.
1:00:30
He's a he's an influencer and he's got a lot good following.
1:00:34
Yeah, So for people who aren't aware, you know, we've started
1:00:36
to put the podcast out on YouTube and, you know, right now
1:00:39
it's a little bit boring, but we're looking at ways to try and
1:00:41
make it a little more exciting in the future.
1:00:42
So stay tuned for that. So we'll leave it there for this
1:00:45
week. Thanks everyone for listening
1:00:48
and we'll talk with you all in the next one.
1:00:52
You've been listening to Identity at the Center.
1:00:55
We hope you've enjoyed the show. Make sure to like, rate and
1:00:59
review and we'll be back soon. But in the meantime, hit the
1:01:03
website at identity@thecenter.com and find
1:01:07
us on Twitter at IDAC Podcast. See you next time on Identity at
1:01:15
the Center.