Latest / Identity at the Center / #199 - Managing IAM with Sarah Cecchetti

Transcript

#199 - Managing IAM with Sarah Cecchetti · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:26
sender podcast, I'm Jeff and that's Jim.
0:28
Hey Jim hey Jeff. How are you not so bad yourself
0:31
doing great episode 199. Uh, come a long way my man.
0:36
Yeah, I still don't know what we're doing but we're doing it.
0:39
I remember when we did our first episode where like watching the
0:43
number of downloads and was like 20 down to is we had 20
0:46
download, double digits double. You're the smartest people in
0:49
the world and we knew everybody who downloaded.
0:53
Oh yeah yeah. I was like eight of them.
0:54
Testing on different devices. Yeah, yeah.
0:57
So I had a conversation with somebody who asks a very
1:02
insightful question which was why do people hire you guys
1:08
Consultants? Why don't they just do it
1:11
themselves? And I had to reflect and think
1:14
about that but I thought there are kind of three areas.
1:18
I want to bounce these off of you and see if you agree.
1:21
So the first one is Kind of lack of experience or capability with
1:27
what the project or effort is that they're trying to do so,
1:31
you know, you and I have a lot of experience in building.
1:34
I am programs. So for an organization that
1:37
doesn't have someone with that experience.
1:40
They bring in quote unquote. The experts I hate calling
1:44
myself the expert, but, you know, so that's number one.
1:48
Number two, was they lack the quantity of staff?
1:53
In order to go at the speed that they want.
1:56
So, you know, they have a limited number of people in the
1:59
team. They want to go fast.
2:01
They want to implement software, they need to burst up.
2:04
So Consultants are a way to do that.
2:06
And then the third area, which I kind of feel like happens to
2:09
least, but it could happen. More is because maybe
2:15
Consultants can do it at a lower cost.
2:18
So those are the three that I came up with is there are
2:20
certain scenarios. I, you know, I think in that
2:23
Last one, it's usually not expert Consulting but managed
2:26
operation. I mean, how many organizations
2:28
do you see? Outsourcing the operations, the
2:33
ongoing support of their I am system.
2:35
I'm seeing it more and more all the time.
2:38
Yeah, I see it more and more but I think you get what you pay for
2:40
sometimes and I don't know if it's necessary, it's been great
2:43
for like yeah, let's keep the lights on but I don't find those
2:45
companies that have taken that step as innovating in the ride,
2:49
any programs they've basically stopped moving forward.
2:53
We have hit the pause button and everything they're doing.
2:54
They really don't care about keeping the lights on.
2:56
I think it's pretty rare that you find a true partner in the.
3:01
In the managed service partner area that is actually still
3:04
continuing to help their customer, their client evolve
3:09
improve stay current with the trends.
3:11
The identity space. They're trying to lower their
3:14
costs as much as possible and especially if they're on a fixed
3:16
fee, you know, sort of like retainer type thing.
3:18
They're not going to volunteer additional work.
3:21
That's going to hurt their margin.
3:22
Right. Hey this isn't so.
3:23
Side baseball for Consulting, right?
3:24
This is how it works, you mentioned a couple things,
3:26
right? So experienced speed, the lower
3:28
cost, I don't know if you get all three necessarily I could
3:32
get depends how you work with the experience.
3:36
I think is the most important one.
3:37
I think you're not your the thing that I think find it is
3:40
most helpful is that you're bringing in people who have done
3:43
it before and who have made the mistakes before.
3:46
So they can tell you what mistakes not to make so that you
3:49
can fail and new and novel ways rather than ways that already
3:52
been done before. So you know, and I think that
3:56
that's just the reality situation is okay.
3:57
Well, you and I have done I don't know hundreds Think at
4:00
this point you know of strategy engagements and advisory and
4:03
assessments and things like that.
4:04
So we have the experience of going across a number of
4:08
different verticals. A number of different companies
4:10
of size. Use cases, Etc.
4:12
We kind of know what works what doesn't work along with their
4:15
own experience in the Enterprise where we both kind of came from
4:18
before Consulting? So I think that's the biggest
4:20
benefit, you know, the reason why you wouldn't want to do it
4:24
cost. I mean, why wouldn't you want to
4:26
get into an ex, you know, get an expert who can do it unless you
4:29
can't afford it and then - right and budgets are big things, but
4:32
she right now with the way the economy is going, not everyone
4:34
has X number of dollars to bring in an expert.
4:38
So to help solve their problems. And I think that's where things
4:40
like this podcast ID Pro, you know, conferences, that are out
4:44
there, things like that, there is a lot of good stuff that's
4:47
out there. That people can kind of tap into
4:50
the accelerator. I think is helping people
4:52
understand, okay? Here's what you want to be
4:53
looking for. Here's what I hear the things
4:54
you need to think about versus trying to figure it out on your
4:58
own and you may be successful or might Take you longer to get to
5:01
that successful State compared to someone who's been down that
5:04
road before I agree. I think conferences are great
5:07
way to learn. I think, one of the best things
5:09
about conferences is when Jim and Geoff, facilitate a session,
5:14
which I posted to my LinkedIn today, that we are facilitating
5:19
a session at the Gartner. Some I am Summit, which is in
5:23
two short months, not even in in Grapevine, Texas.
5:28
And I put the post out there You see if folks would volunteer
5:33
questions because we're going to do more or less like a fireside
5:37
chat and but no fired with no fire, maybe a flamethrower.
5:44
Yeah. Anyway I'd love to kind of
5:47
gather questions but my other question for you.
5:50
So looking at the agenda for identi verse now and kind of
5:55
gearing up for us going there. And what I wanted to know is,
6:00
will you You do the morning yoga session with me?
6:05
No Sunrise. Yoga.
6:07
Thank you, though. Appreciate it.
6:08
I will be somewhere getting trying to find Chicken and
6:10
Waffles. If I can and carving up.
6:13
Right. I gotta, you know, be ready to
6:15
go for the day. Yeah, well, there's no better
6:18
way than to start with Sunrise yoga at 6:30 a.m.?
6:22
Yeah. No, that's going to be a no for
6:25
me, dog. As I Randy Jackson would, like,
6:27
to say you mentioned the Garter thing, but definitely get this
6:30
out there. We're trying to, you know,
6:32
really come up with good questions that we can ask the
6:35
Gartner analyst out there. They've been very gracious so
6:37
far. If you are concerned at all
6:39
about what you might want to ask in public, I did reply to your
6:42
comment on LinkedIn or your post on LinkedIn.
6:44
Feel free to DM me. I will keep your secret identity
6:47
secret, and we're going to take the best questions and try Jan
6:50
them. Only half an hour, and there's a
6:52
couple of you, and I've already come up with and we want to make
6:55
sure we try to get, you know, good solid hard questions that
6:59
we can really Grill, Henry, Kay. And Becky on.
7:01
So if they're listening, I hope they are prepared.
7:05
The intent is to really get to the belly of the Beast as we're
7:09
calling it for the gardener. I am conference.
7:11
Yeah. Absolutely, anybody who
7:14
volunteers to question two, I'm going to make an offer.
7:18
You DM. Me your mailing address and I
7:21
will send you an identity to Center sticker, which is like
7:27
one of those cool vinyl stickers which is whether Proof.
7:31
It's also dishwasher proof and yeah, but I think most people
7:37
will put it on their laptop lid, so that's kind of cool.
7:40
I don't know, I mean, this is exclusive thing.
7:42
I don't even have a sticker, so people be a have them.
7:45
Our friend, Stephen strong has put a sticker on the back of his
7:49
trailer. So, somewhere in the Seattle
7:51
area, is and identity at the center sticker on the back of
7:54
his. I'm not sure what he's toting
7:56
around in there, but that's the only sticker that I'm aware of
7:58
in the wild. But be cool to see more out
8:01
there. So yeah.
8:02
DM Jim your address and he will send you all try to remember to
8:06
put the sticker in the in the letter before he mails it and
8:10
that is something that's like joke.
8:11
Yeah. All right.
8:13
Why don't we get to our topic du jour?
8:15
Because we've covered a lot of topics that she can certainly
8:18
help us with. I'm very happy to have Sarah
8:22
cicchetti back with us. She is the head of product for
8:25
AWS Cognito. She's a co-founder and board
8:27
member of ID Pro and this is her third time.
8:30
Time on the identity of the sender.
8:31
Podcast, welcome back, Sarah hola.
8:35
So it's been a while. The last time you were with us
8:38
in person in quotation marks because we're all virtual at
8:41
this point Rights was episode 101 where we talked about AWS
8:46
Cognito. And at the time they about to or
8:50
new re-released CID Pro certification from ID Pro, so
8:56
I'm sure a lot has happened going to cover that.
8:58
And then after that, we did a An episode.
9:00
And by the way, that was like, whatever.
9:02
I think our most popular episode that we've ever done.
9:04
So, if you haven't heard her episode, that's a great one
9:06
everyone. For whatever reason decides to
9:08
go right to 101, which is fine with me because episode 1,
9:12
frankly sucks, because it's literally me on Zoom, with Jim
9:16
on a echoey basement office. And it's not the best audio.
9:19
Quality content is good. I think, but the presentation,
9:22
we will more desired. So there we go.
9:24
One-on-one Sarah. Why don't we start there real
9:27
quick? Because if I, if people want to
9:29
know their order, Origin story. They can always go back and
9:31
listen to that. How is, let's start with CID
9:35
Pro. It's been a couple years.
9:37
How's that going? It's really exciting.
9:41
We've had a number of different people take the test and a vast
9:45
majority of people are passing. They tell us it's a hard test,
9:49
it's really challenging. It makes them feel like They
9:56
don't know everything about identity, which is true for
9:58
everyone, right? No one knows everything about
10:01
identity, but at the end of the test, you get scores for each of
10:04
the five different pillars that are on the test.
10:07
You actually know like, okay, I passed.
10:10
But this is how well, I didn't each area.
10:12
Like this is where I can go and read more of the body of
10:15
knowledge, which we'll talk about later, and and kind of
10:18
expand my skills. So, it's, it's been valuable,
10:21
not just from the point of view of validating.
10:23
Like, yes, I am an expert in this.
10:24
I do know what I'm talking about but also helping you understand
10:28
where your growth areas are. I think that's super unique and
10:31
super cool because usually, you take a certification test.
10:34
This is like, did I pass or fail?
10:35
How did I do? I don't know.
10:37
And you don't really know what how you did and what are easy to
10:39
study on. I could tell you it's not a
10:41
pushover test for sure. I am fortunate enough to have
10:44
been involved in the first round of creating questions.
10:47
I think I have I don't know if my question is still in there
10:49
but that is not a pushover test so people who are CDI CID Pro
10:53
certified. Know their stuff.
10:56
Yeah, maybe they're not 20 years into it, but they definitely had
10:58
to, you know, study and have some experience to get this
11:01
done. I think the target for it is
11:03
what two years I think of experiences is that roughly kind
11:05
of what it was looking at, or was it more or less than that.
11:08
Yeah, so we had a bunch of identity.
11:10
Experts yourself excited. Me included, right.
11:12
Questions for the test, the questions are hard, but when we
11:15
calibrated the test, we had a bunch of identity experts take
11:18
it. We knew how long each of them
11:20
had spent in the field. And so we said, okay, where
11:23
should we make the cut line? This test, is it?
11:25
You have to get 70% of the questions, right?
11:27
Is it have you 90% of the questions right?
11:29
And we made the cut line, right? At people who have less than two
11:32
years of experience, answered fewer than this number and
11:35
people who had more than two years of experience answered
11:38
more than this number correctly. So if you have two years of
11:41
experience in the field on average, you should be able to
11:44
pass the test. Yeah, I it's a good test.
11:48
I'm definitely recommend you to folks, to go out and take a look
11:50
at it. We always talk about ID Pro, I
11:52
think hands down. The thing that has mold Most
11:54
worth it is the slack Channel and just having access to so
11:58
many smart people. I know that I've asked questions
12:00
in there and gotten answers, you know, pretty much right away for
12:03
my daily work, and things like that.
12:06
Even if even if you are a lurker, which I tend to be in
12:09
those types of scenarios, it is so worth it just just for just
12:13
the slack Channel. Yeah there are a lot of Industry
12:15
organizations that are just kind of collections of vendors and
12:18
different ways for vendors to sell it.
12:20
You and Ida Pro is really just a collection of like doers who are
12:23
like oh God. Don't do that.
12:25
Don't use that products. Like, you'll hear a lot of
12:27
negative things, which I think makes people feel like, oh, this
12:29
is an authentic place to be and to hang out and to get honest
12:32
information. Yeah, it's a cool spot.
12:34
I mean, I think I just want things I enjoy about.
12:36
The identity industry is, you know, for the most part I feel
12:38
like people are very welcoming and sharing and for a lot of
12:42
folks, this is not Secret Sauce information that they're trying
12:45
to hide something like that. Is competitive for other
12:48
reasons. Almost, obviously you're a
12:50
vendor or something like that, that might be something.
12:51
But for the most part, you know, people willing to answer
12:53
questions. Share opinions, which I find the
12:56
best part because sometimes we talk with analysts and other
12:59
things, they won't share an opinion on something.
13:01
They will give you a fact and not tell you why, something is
13:05
the way it is, or what they really feel about it, and things
13:07
like that. It Pros, totally different,
13:10
you'll hear from the toriel Sarah, Ian, you know, Eric a
13:14
whole bunch of people who are out there just answering
13:16
questions and telling you how they see it.
13:18
And, you know, it's it's a good spot to kind of collaborate.
13:23
Commiserate celebrate whatever may be, and there's a whole job
13:26
or to there, which is cool. So if you know, for people who
13:28
are looking for identity work, there is a channel dedicated
13:31
specifically to finding roles within the identity field.
13:35
I think that is are all weaving around the world.
13:37
So it's not just focused on the US, its Global nature, which is
13:40
pretty neat. The other episode that you were
13:43
with us. Was episode number 151, another
13:46
very popular episode where we reached out to a bunch of our
13:50
identity. Rowdy Friends yourself included.
13:52
And we asked Question, what is the difference between digital
13:55
identity and identity and access management?
13:58
Now, I would like to play your clip that you sent us that we
14:02
played on that show, just to refresh people's memories
14:05
because after you listen to this, and it's about 2 minutes
14:07
long or so, I'm going to ask you the question.
14:09
Has your opinion changed anything having heard from the
14:13
five or six other folks that we asked and the five or six other
14:16
different answers that we received from the different
14:18
people and identity. So let me play that clip now and
14:21
then we'll keep going here. There is no difference between I
14:25
a digital identity, and I suspect that's what many experts
14:27
will tell you, but that's not true.
14:30
There's a very important and overlooked difference.
14:33
There's a division of the US government called the National
14:36
Institute for standards and technology or nist and their job
14:39
is to measure things. How long is a meter, ask Nest,
14:43
how heavy is a Colombian ask missed well in the 21st century,
14:47
they started measuring not just physical things, but digital
14:50
things, like, security, and identity.
14:52
They wrote a document called special publication 800-53, the
14:57
publication outlined a way to measure how strong an identity
14:59
transaction was and it used to measure called level of
15:03
assurance. How sure can I be that the
15:05
person at the end of the line is who they say they are.
15:08
As that document, when into broad use, they found it had
15:10
cracks in its armor. It wasn't doing the job that it
15:13
was intended to do because it was too one-dimensional, and it
15:16
was one dimensional and exactly, the access that we're focusing
15:19
on. In this episode, it conflated, I
15:21
am with digital identity. It said that the strongest
15:24
transactions have both strong authentication mechanisms and
15:27
strong identity proofing, meaning that we verified the
15:30
real-life identity of the person at the end of the line.
15:33
But that measure me leaves, no room for a very important use
15:36
case, strongly authenticated, Anonymous users.
15:41
Imagine a political dissident who wants to tell the story of
15:44
what she's experiencing in her country, but she needs to keep
15:47
her identity hidden so that her government won't find her.
15:50
Do we need strong authentication for that person?
15:53
Absolutely. We need to use the strongest
15:55
technology we have to make sure that her lines of communication
15:57
haven't been compromised. Do we need strong identity
16:00
proofing to make person? No identity proofing.
16:03
That person could actually compromise her safety.
16:06
We need strong. I am without strong visual
16:09
identity. That's when Miss hired a team of
16:11
identity experts, including myself to rewrite the whole
16:14
concept of identity verification.
16:16
We threw out the one-dimensional motor and made it three
16:18
dimensional now. Stead of one level of assurance.
16:21
There are three identity Assurance level authenticator
16:25
Assurance level and Federation Assurance level because I am and
16:29
digital identity are, and must remain different.
16:32
So, Sarah has your opinion changed?
16:35
No. In fact, I think this has gotten
16:36
even more important like as we're seeing Wars and Ukraine.
16:42
And Russia is we're seeing civil unrest in our on like we need to
16:46
get first-hand accounts of those things.
16:49
And at the same Same time. We're seeing a lot of upheaval
16:52
and Twitter and saying, oh you have to be verified, we have to
16:54
know your real name. You have to have a credit card,
16:56
right? Or we're not going to promote
16:57
your content. We're not going to show you in
16:59
search. We're not going over going to
17:00
Shadow ban you. Right?
17:02
And so I think it's a it's a really important topic.
17:04
More that I had that ever to say is this actually a valuable
17:08
thing to know someone's real name, like it certainly valuable
17:12
to know they're human it might be valuable to know where their
17:17
citizenship is and so this isn't An interesting place where we
17:22
might want some zero, knowledge proof technology to come along
17:25
and say like, I don't want to know who you are but I do want
17:27
to know that you're a US citizen.
17:29
I do want to know that you're a human.
17:31
I do want to know that you're an adult.
17:33
Is there a place for anonymity on the web?
17:37
I think there has to be, I think if we want people to be honest
17:41
and have free speech, you have to allow them to say things
17:44
without using their real names. Right, I agree, I think that's
17:49
important, but I think there's a danger that comes along with
17:52
that. I mean, some of the kind of the
17:54
vitriol, we see in message boards.
17:57
I mean, it ties back to people's ability to be anonymous and
18:02
would they say those same things if someone knew it was them
18:05
saying them. Sure.
18:07
But there are other solutions to that like moderation.
18:10
That doesn't mean that we have to get rid of anonymity
18:12
altogether. Yeah, good answer.
18:15
I know what I thought when we were going through it episodes
18:17
like yeah, I think you had the most academic answer but you
18:21
know after you after we listen to your answers like yep I
18:25
agree. And then we had Ian's and every
18:29
listing that and it was different like yep I agree.
18:33
And then we had, you know, one which we played On a different
18:38
episode from fried entity and he made his analogy of like, it's
18:43
like football. You be talking about the
18:46
physical object of a football or you could be talking about the
18:49
this idea of a game that we all call football.
18:53
And I was like, yeah, that I agree with him too.
18:58
Yeah, I feel the same way. It was like the, the context
19:00
changes based on who you're talking to, and what I found
19:03
interesting about that conversation was of the people
19:07
That we had on that sent us something.
19:10
Only one person was not an identity product person and that
19:15
was Adam from Texas A&M and he had a completely different
19:20
answer to. What was generally kind of
19:23
agreed. Sort of a, you know, I think
19:26
what we call like a disagreement of identity was still, sort of
19:29
an agreement and Adam was the only one who had a completely
19:33
different. He actually flipped on his head.
19:34
He saw, I am a sort of like the thing.
19:37
At the top and then July 2nd is the thing below that, whereas
19:41
everyone else saw it flipped the other way.
19:43
And I wonder if that was something because of how close
19:46
maybe people in the identity industry, are we work in the
19:49
stuff day in day out and Adam is running an identity program.
19:52
For I think the largest university system in the world
19:55
as far as I know. So he has a totally different.
19:59
He's that he's more of a consumer of identity products
20:02
whereas you you're managing a team of identity people and your
20:05
building. Aw, Magneto and other identity
20:08
type products. The same as like, Ian for
20:10
Salesforce and and Jamie at Sadie and things like that.
20:14
And I wonder if if it's being so close to the problem, you know
20:20
Shades your answer One Direction or another.
20:22
Well I think it speaks to what a poor job we've done as a
20:25
community of actually defining our terms and making them
20:29
consistent. That's something we're trying to
20:30
do is part of Ida Pro. There's a article in the body of
20:34
knowledge that is just terminology and some Of the
20:38
words in the terminology have multiple definitions, right?
20:41
Because different people to find them different ways in different
20:43
contexts. And so we're at least trying to
20:46
codify all that in a way that's free and online where people can
20:48
go and look at it. But yeah there's a there's a lot
20:52
of things that the identity Community has done in a terrible
20:54
way like every time I get an Uber and they're like what do
20:56
you do? I'm like I work on login systems
20:58
and I'm so sorry that we suck at our jobs.
21:01
Yeah. I guess it's a question to us
21:03
like, well how do you do like well I'm a security consultant
21:05
so what does that mean? Say well, you know, I IDs and
21:07
passwords that sort of thing. And then it's like, all right,
21:10
end of conversation. They have no desires.
21:11
Talk to me after that me. Hi, I'm the problem.
21:14
It's me about that, but I think that was the Genesis of the
21:17
conversation is because there are so many different, you know,
21:19
different interpretations of that answer of, you know, what
21:22
is identity and Jim and I have this joke and this is something
21:24
I've been doing for years. We have, you know, we ride
21:27
anywhere, I'd any Nexus management experts, right?
21:29
And then one of us might ask well, you know, at the end of a
21:32
session will what is I am? What is that?
21:34
And it's just a running joke that Jim If it's kind of stupid
21:38
inside baseball. But let's talk about identity
21:40
and access management and managing a team because I would
21:44
imagine you have a pretty large team that you're managing from a
21:47
Cognito perspective. And I think this is an area that
21:50
we really haven't touched on is what is it?
21:53
You know, what is it, like, to manage people in the space of
21:56
identity, we talked, we talked an awful lot about technology
21:59
and standards and how things work but people are still the
22:04
biggest equation when it comes to making all this.
22:07
Work and as the actual end users and real want to kind of get
22:10
into what is it like to manage an identity team and I guess
22:14
I'll just start off the question.
22:15
You know, what's the most important thing that people
22:17
should know about managing a team?
22:19
Is there any difference between managing a normal team as I'll
22:23
say versus an identity and access management team?
22:26
Not that they're not normal but I hope you get my drift.
22:29
Yeah, I think one of the hardest parts of managing identity
22:32
projects in managing General software projects, is that the
22:37
Timelines are really unpredictable, right?
22:39
Because identity is a security perimeter.
22:41
It has to have really high usability, it has to have really
22:44
high availability, right? At the login system is down.
22:47
Nobody's doing work, nobody's, buying, widgets, nobody's, doing
22:51
whatever they're supposed to be doing.
22:52
So, we have to have extremely high usability.
22:54
We have to have bulletproof security where subject, to a ton
22:58
of regulations, the security regulations.
23:00
And if you're in the consumer identity, portion as Cognito is
23:04
your subject to International SMS, Nations which are changing
23:08
constantly to try to combat spam and how do you, how can you use
23:12
long codes? How can you use, short codes?
23:13
What are those costs? Look like we're subject to App,
23:16
Store, regulations, and then like we are middleware, right?
23:22
We have 100 things Upstream. We have 100 things, Downstream,
23:25
all sorts of things could break us, if they make small changes,
23:27
we could break all sorts of things Downstream if we just
23:29
make small changes. And so, if we want to make
23:32
really big changes, that means that you've got to get a whole
23:35
bunch of people on board and And ready to work.
23:38
So it's it makes the timelines really unpredictable.
23:42
So if you are an identity team manager or you work in an
23:45
identity team, you're going, oh my God.
23:47
Like why do these projects never come in?
23:49
When we think they will, like, you're not alone.
23:51
That is, that is completely consistent with what the rest of
23:54
us are feeling. And that's part of being an
23:56
identity team. Is that like you go with the
23:59
flow and things get done? When they get done sad, but
24:02
true, but I guess solace in the fact that you are not alone,
24:05
right there are is the Equation of it.
24:07
And I think about when we think about building an identity team,
24:11
there's also the human side of it to say, okay, well who are
24:15
the people that we're going to have on this, who's going to
24:16
work on what? And can we find the Unicorn?
24:20
That knows the technology is great at documentation
24:24
understands how to communicate with customers and clients and
24:28
things like that. Oh, and oh, by the way, they're
24:30
also really cool to work with right.
24:31
There is no personality issues there that might cause conflict,
24:35
I guess from your perspective, You know, I think I know what
24:39
your answer is going to be. I'm going to ask it anyway,
24:40
right? Do you hire for knowledge or
24:42
attitude if you can't find both? Yeah, I mean ideally, we want
24:46
both but finding knowledge is hard, right?
24:49
Finding identity experts is really difficult.
24:51
Amazon pays a lot of money and we have trouble finding people
24:54
who are identity experts. When we do it's great, I love
24:57
working with Dean sacks and Aaron Crow and all the people
25:01
who I work with who are just amazing.
25:04
But obviously that's hard to find.
25:05
So as soon as you get a critical, Mass on your team.
25:08
What we tend to do is just higher for ability to learn,
25:11
right are and are you a nice person who will help others
25:15
learn once you get to be an expert and not just sit in a
25:19
room by yourself and tell people to go away miserly?
25:22
I am wizard, you, no pay no attention to the man behind the
25:25
curtain, whatever it may be. Jim I know this is a topic that
25:28
comes up a lot, right? It's like we always get asked,
25:30
it's like what does our? I am team look like and I don't
25:34
know. I'm going to ask that.
25:35
Question is if I was a client and I'm trying to stay It up and
25:37
I am program and services at the Enterprise level.
25:40
So, not on the product side. But hey, a consumer of these
25:42
Services out to my my users. What do you know, what do we
25:47
kind of think? As I kind of our viewpoint on?
25:49
How do you build an? I am team to start with?
25:52
Yeah, I think it roughly is shaped like a pyramid, right?
25:56
You have to have people with a lot of experience, a lot of
25:59
knowledge at the top, but I think to Sarah's Point like
26:03
having people who work well with others, so you can kind of Build
26:07
that team, there the wide part of the triangle and the bottom
26:11
of people who have less experience, the less technical
26:14
skills, put them in the right training, get them the right
26:18
project experience and invest in them.
26:21
They'll then move up the pyramid and I think one of the risks is
26:27
that you know those people may leave your organization, this
26:30
happens, no matter where you are.
26:32
I'm sure even Sarah thinks about that with like at Amazon like
26:36
hey, These people might move out either to other parts of Amazon
26:40
or they might leave the organization to go, make more
26:42
money elsewhere. But look, that's what we have to
26:46
do. We have to invest in people
26:47
because, you know, one is the right thing to do.
26:51
But number two, some of the people are going to stay, right?
26:54
And if you don't invest in them, they're still going to move up
26:58
the ladder that just won't be as prepared.
27:00
So you know, those were my thoughts, but what about you,
27:03
Jeff? Yeah, I feel like you're totally
27:06
right on, right? I think if you try to plan
27:08
around the worst case scenario, you'll never get anything done.
27:11
So if anybody, if you're operating good effective team
27:15
that takes care of your own team members and gives them
27:17
opportunities, and things like that, I feel like that's kind of
27:20
stuff that it will work out in the end.
27:22
Give me attitude over knowledge, any day, if I can get both
27:26
fantastic, but if I could only have one, I feel like I could
27:29
train the knowledge. It's much more difficult to
27:32
break habits personalities. It's things like that.
27:35
And, you know, everybody wants to work with people that they
27:38
like to work with Jim, you and I been working together for 89
27:41
years. Now, at this point, we are
27:42
complete opposites in real life and yet it works, right?
27:45
Which is whatever it is, whatever reason and so I know
27:48
how people think we're twins, right?
27:50
Yeah, I do. Yeah, we couldn't be further
27:52
from that and I don't know how that even as possible.
27:55
But okay, let's talk about the knowledge aspect of it though
27:59
because that's probably the next step, right?
28:01
Is I think we can find people who have good attitudes.
28:03
I think we all have those people in our Lives and teams that they
28:07
are just, you know, great people.
28:08
How do we embolden them? And give them the tools, they
28:11
need to grow better or to improve their knowledge in a
28:14
certain area and I'm curious Sarah from your perspective.
28:17
Like what do you establish is sort of like the Baseline for?
28:20
I am knowledge as someone joining your team, you know, if
28:23
it's I would imagine is probably difference if it's someone
28:25
who's, you know, never had a job before or not, you know, not in
28:28
that space versus maybe a couple of years or maybe even more like
28:32
what is how do you establish that Baseline?
28:34
We do. Do a lot of things.
28:36
It's not easy to get people up to speed and identity, but the
28:41
first thing we do is have them join it Pros.
28:42
So little plug here, Ida Pro dot-org, Amazon as a member at a
28:49
level where we get unlimited memberships.
28:51
All of our employees, can go be members of ID Pro.
28:54
I would highly recommend that for your organization and that
28:56
just gives them a place where they can go ask any question,
28:58
right? I have a stupid question about
29:00
Samuel. I have a stupid question about
29:02
open ID connect. I have a stupid question about
29:03
idea. Whatever it is.
29:05
And very nice people will come and help you and share their
29:09
experience with you. So that's, that's a big part of
29:13
it, pointing them toward the body of knowledge and having
29:16
them read, especially the intro to Identity article and the is
29:21
Sean's. MSA for humans, article is a
29:23
great one to doing those. We try to create a culture where
29:30
it is okay to escalate and they know what they should be
29:33
escalating about. Out.
29:34
So when they see something, that might be a security issue like
29:38
hey we were testing this with fake user data and we noticed
29:42
that fake user data showed up in the logs.
29:44
Like should we be paging someone like yes.
29:47
You should be paging someone. And if it turns out that it's
29:50
fine, and it's not a problem, and that was totally intentional
29:52
Behavior. Then you say, you know, this was
29:55
unnecessary. But thank you for paging me,
29:57
right? If you tell them, like, you
29:59
wasted my time, stop doing that, think more about what you do in
30:02
the future, right? If you're mean to them, then the
30:04
That happens. They're going to be like, oh, I
30:07
better not, tell Sarah about that.
30:09
She's gonna be mean. We always want to make sure that
30:12
like, if someone is bringing up a security issue no matter how
30:14
it. Like, there's a 1% chance that
30:16
something is wrong but they get priced for like, yes, please
30:19
bring that to our attention immediately.
30:21
That's a huge part of it on my team.
30:23
We have a weekly learning meeting for half an hour where
30:25
we just re-watched identifies video, or we read an article, or
30:28
we do something, and it's a forcing function for us to go
30:32
and keep up on the industry and learn Learn what people are
30:35
writing and saying, and reading about different identity topics.
30:39
So that's a huge part. And we have our new Engineers
30:43
actually get on the phone with our customer support people.
30:46
So, they'll sit right next to a customer service rep, and
30:49
they'll put on their headphones and just listen to customer
30:51
support calls and be able to hear first-hand.
30:54
Like this, is the pain that customers are having.
30:56
This is the confusion that customers are having so that
30:58
they get a real feel for what the customers are going through
31:03
and how they can help. How In build Products that come
31:06
back that. So there's a number of different
31:08
things that we do to help get our team up to speed, but it's
31:11
hard. It's challenging and we're
31:13
constantly evolving how we do it.
31:15
I find that interesting that you have people sit in on actual
31:18
customer calls, kind of your things.
31:19
Can you talk a little bit more about that?
31:21
Because that's, that's a little bit unique.
31:23
I don't know if I've heard that one before.
31:24
It was a way to get people sort of up to speed on the identity
31:27
questions being asked. And I bet that there's probably
31:30
some parallels that maybe people can take, even the Enterprise
31:32
scenario. Like, what are people calling?
31:34
For password, resets, or things like that.
31:36
And really kind of listening to the customer and probably their
31:39
frustration with something that's not working.
31:41
Absolutely, it helps us understand what terms customers
31:45
doing, don't know, right. It's a lot of people tried to
31:48
build identity systems, like I'm just building an app and I need
31:51
to build a login and I don't really know anything about
31:53
identity yet. This is the first time I'm
31:55
trying to do this. And all of a sudden, I'm
31:57
drowning and documentation about oauth, Scopes and claims.
32:01
And all of these terms that I don't know what they mean, and
32:03
I've never heard of and what's it say?
32:04
Okin and where can I store the token?
32:06
Should I store the token? And so those kinds of questions
32:10
are things that you know may not even occur to the average
32:13
developer that, oh, somebody doesn't know this.
32:16
Like they assume that the people who are building our identity
32:19
experts and they all know. And that's not the case, right?
32:22
Like when we build things, we have to be very, very clear as
32:26
much as we can. In plain English about this is
32:28
what this system does. This is how you make this
32:31
decision. So having them on those calls
32:36
and hearing that firsthand directly from the mouth of the
32:39
customer is really helpful. It's nothing like pain.
32:41
And someone's voice to really jolt someone into doing the
32:44
right thing. You talked about the body of pro
32:46
body approach the the ID Pro body of knowledge.
32:50
You talk about sitting in a conference calls and sort of
32:52
learnings around different webinars that are going on.
32:55
And I think one thing that I'd like to control it is
32:58
conferences because I feel like things like identifier sand
33:02
Gartner's. I am Summit and and touching
33:05
things like identity, we can Chrysalis and like it seems like
33:07
there's no shortage of places for people to congregate
33:10
physically and kind of talk about different things.
33:13
How important do you do you see conferences as part of
33:17
development and Jim, we're going to ask you the same question is
33:20
like, how do you see that as being important for?
33:22
For folks? Get on there, cuz I'm curious to
33:23
see how he answers me. There might wind up or maybe not
33:25
Sarah wants to go first. I think it depends
33:28
person-to-person kind of what they need, if they have no
33:31
exposure to the identity Community.
33:32
I absolutely like this. To be going to conferences, they
33:36
should be meeting people. They should be asking questions.
33:38
They should be getting an idea of like these are the conference
33:41
presentations that happen for someone who's been to
33:44
identifiers for like five years in a row.
33:46
Then I'm like, okay, you probably can do most of the
33:49
presentations that are going to be.
33:51
There is that it is that the best use of your time, Maybe
33:55
not, maybe you should be presenting, maybe you should be
33:58
trying to get a keynote slot, right?
33:59
Like maybe you should be trying to level up your level up your
34:02
skills or go to something different.
34:03
Go to A European identity conference and see like, how are
34:06
they talking about things? There's way more of a focus on
34:09
consent, on privacy, on open banking on things that are not
34:13
issues in the US and so that that ability to go to Regional
34:16
conferences and see how different identity is in
34:18
different places in the world. Really interesting really
34:21
valuable Jim about yourself, a feel like for you and I we
34:25
probably have a little bit different take just because the
34:26
future for a job. I feel like it's networking is a
34:28
big part of getting out there and meeting people and things
34:31
like that. Do we actually Ed ever learn
34:33
anything These conferences. Now we do.
34:36
I mean, you definitely learn through osmosis but you also, we
34:41
get to attend some of the sessions, but I just thought
34:43
that stars answer was perfect because attendance to
34:47
conferences. Really what you get out of it is
34:51
going to depend largely on where you are in your career path of
34:55
your earlier in your career path.
34:57
Just sitting in some of the sessions and the networking you
35:01
know, that's where you're going to get a lot of benefit as you.
35:04
You move further into your career contributing is going to
35:09
be more important. I also was just thinking about
35:14
it from. I mean, look what you sir are
35:16
tight. Everybody company's management
35:19
got used to not traveling and not sending people to
35:24
conferences during covid-19 Alex back and I think they're kind of
35:29
slowly, you know, getting back into making that investment.
35:32
But Companies have to, you know, it's a cost a lot of money to
35:37
send somebody to a conference. You know, you've got the
35:39
conference pass and then you've got the travel.
35:43
And so, I think, you know, if you're an, I am company, you're
35:48
probably going to look at it, like, okay, business development
35:51
is going to be your number one priority, but I think one of the
35:55
other key priorities is rewarding High performers.
35:59
I think this is the independent of.
36:00
If you're in the I am industry or your company.
36:04
And you're doing, I am. It's if you got people on your
36:07
team who are high performers, doesn't mean you need to send to
36:10
every conference, but most people, I believe, look at being
36:15
sent to conferences as something that is like a reward.
36:20
So they get to go, they get to network.
36:24
They get to go out to some nice dinners maybe and to me that
36:28
that's part of it. What do you think?
36:31
Not again spot-on. I mean think I you have to like
36:34
to do it. I think a I recognize the fact
36:36
that not Everyone likes being in that sort of social you know
36:40
environment right with potentially hundreds thousands,
36:44
tens of thousands of people that is not comfortable for a lot of
36:47
people and I think at least offering it as a choice is an
36:50
option for people who are interested.
36:51
Great you're totally right about the travel thing and it's not
36:53
cheap to go out and stuff and I think people have not been going
36:56
to converse the last couple years, I was at RSA right before
37:00
things. Kind of shut down for covid.
37:02
You know, few years ago, it was kind of like the last hurrah.
37:05
And then things just went downhill from there is like
37:07
nobody's doing anything in person and then I was at RSA of
37:10
last year when things kind of opened back up and there was
37:12
like this celebratory feeling of hey we're back we're back.
37:17
Covid is no more not, maybe not necessarily true but there was a
37:21
there was a sigh of relief that's like Hey we're getting
37:23
back to this, do you think there is value of being, you know, in
37:26
the same place? So people hearing the hallway
37:28
conversations that take place are Are things that just don't
37:32
normally happen on us, Zoom call, write or, you know, in a
37:35
text message or an email or things like that.
37:37
That's the kind of stuff that I find, really invaluable.
37:38
I always point back to, I think it was the coup, bring ercole
37:43
conference a few years back on customer identity for Roger
37:46
Grimes. And I were at like a little
37:48
table outside of this room and he explain Quantum Computing to
37:51
me. And now I'm an expert on Quantum
37:53
Computing. Just based on that 45 minute
37:54
conversation that Roger was So Graceful with this time within
37:58
the money. And you know, just educating me
38:00
on the spot. That would not have happened.
38:02
If he and I had both not been there right him to impart his
38:05
wisdom and share his perspective and me to absorb that like a
38:08
sponge as much as I could. So I think is super valuable,
38:11
but I think as Leaders of teams and we all are that is we have
38:16
to understand that it's not always the appropriate choice
38:18
for a person. They may not be comfortable in
38:20
that role and that's okay too. Maybe it's a virtual pass, maybe
38:23
it's some other, you know, learning development, you know,
38:26
things like that, that, that that they might be more
38:27
comfortable with. And I think we have to
38:29
understand and be okay with that.
38:30
As well. They might see it as a
38:32
punishment. It's like, what do you mean
38:34
you're sending me out? I don't want to go to.
38:36
I don't know. Someplace cold in the middle of
38:38
winter. Like that doesn't sound like
38:39
fun. Let's talk a little bit about
38:43
that. That concept of managing
38:45
identity 18 and I'm curious Sarah from your perspective.
38:47
What is something that you wish you knew about managing a team
38:51
of identity engineers and analysts or whatever it may be?
38:55
That you wish you had known that when you started that might have
38:58
made your life a little easier. It kind of falls into what we've
39:01
been talking about. I think one of the, one of the
39:04
mistakes I made us an early manager was I put my people on
39:07
things, they were good at And what you do then is you use
39:12
cement their skills and keep them from growing, right?
39:15
So when I joined AWS, they were like, oh my God, Sarah is an
39:18
amazing speaker, right? He was an exemplary, Erse
39:20
speaker, she's been identified. As keynote.
39:21
She's a top 100 influencer women, in cybersecurity
39:25
speakers. All he's saying is and my
39:28
manager is immediately, like, yes, top doing that.
39:30
Like you need to learn pnl, you need to learn leadership.
39:32
You need to learn like all these things like stop spending all
39:36
your time doing something that you're already good at.
39:39
You don't need to learn that and so when I get a project on my
39:44
team that's like yeah this requires a whole bunch of data
39:46
and Analysis. Like I don't go to the guy who's
39:49
great at data and Analysis, I go to the person who needs to learn
39:52
that and I mean, unless we're on like some crazy tight deadline,
39:56
right? And we need our star players but
39:59
really expanding the the capabilities of your team means
40:03
that you don't put the best person from the team on the job.
40:07
What do you do to support that person?
40:09
What's the support systems in place where they understand
40:12
them? Maybe they're not the expert on
40:14
it, but you're trusting them or giving them the tools that they
40:17
need to be successful and ask questions and things like that
40:19
because I think sometimes there's this I don't fear or
40:22
whatever it may be is like well I don't know how to do this so
40:24
and then I can't do it or I'm afraid to ask questions without
40:26
you know what's the support system?
40:27
You put in place to help those folks out.
40:29
You've gotta cultivate a culture where failure is okay.
40:33
So, like the way that we incentivize, our leaders at AWS
40:36
is that you have to meet 70% of your goals.
40:39
If you're meeting a hundred percent of your goals, then
40:41
you're way too comfortable. You're not learning anything.
40:44
And so, if you're meeting 70% of your goals, then like you're
40:47
really trying, you're really stretching yourself.
40:49
You're trying to do more than you've done in the past and
40:52
you're failing a little bit and that's good, right?
40:54
You should be feeling a little bit.
40:55
That's how you learn. I love that idea Jim.
40:57
What about yourself? Any tips for how you would, you
41:00
know, support somebody who maybe, you know, we come across
41:03
every day, right? Nobody's an expert in
41:04
everything. Right?
41:05
How would we approach that on our side?
41:07
Yeah, I know, you know, Don't know if I have any real Pearls
41:10
of Wisdom year but, you know, I kind of I love identity and
41:15
access management and I think that everybody should.
41:19
And I think that, you know, you have to be prepared to some
41:23
people. This is just a stop along their
41:25
path in their career and they're going to go do some other
41:28
things, but I will say I didn't access management projects are
41:33
hard. You know, I kind of feel like I
41:36
talked about, I am as middleware a lot.
41:39
And you know what's hard with middlewares?
41:42
It is basically technology that's connected to other
41:47
systems. So so many other systems depend
41:50
on it. That makes everything more
41:52
complicated from the development to especially testing and then
41:56
when you go into production, how you keep, you know, to change
42:00
not only within your application but all the connected system to
42:04
make sure that things don't go awry.
42:05
And so you know I think that it's not for Everybody.
42:11
But for folks who like really get a charge from a challenge
42:16
like that I think can be a great place to build a career.
42:21
I think it's good. I think it's good advice, right?
42:24
I think the three of us. Our identity lifers, probably at
42:27
this point, but I think it's important right.
42:29
That future see sales, right? They may not be an identity
42:32
expert, but they should be walked coming through at least
42:34
some of this on their way there. And I would certainly encourage
42:37
folks to you know, even if you're not interested in being
42:40
an identity lifer and you're not that knots like we are you need
42:44
to know this stuff to be able to really come up with a adequate
42:49
and effective information. Security plan, whatever that is,
42:53
you have to know what you're going to protect.
42:55
Who's got the keys at the castle, right?
42:56
All that stuff. That's all fundamental.
42:58
All the marketing terms that people have heard of last couple
43:00
years, zero trust. Guess what identities at the
43:02
center that too. So you need to know that stuff.
43:05
So even if it's not your primary domain or expertise within
43:09
cybersecurity, for example, our information security, you still
43:12
need to be Converse it and understand it and in those cases
43:15
you lean on the experts, right? And maybe Jim like your
43:17
question. Um, maybe that is where you
43:19
bring in a consultant because you know, No, maybe 20% or 40%
43:23
and you bring in someone who can fill in the Gap to get you.
43:25
The rest of the way 100%, you know, in in a certain area would
43:28
rule, maybe I think you answered a question that I was going to
43:31
ask next to Sarah, which is what is the biggest challenge that
43:34
you have today about managing? I am saying you mentioned just
43:37
how hard it is to actually do my taxes management projects
43:41
successfully because of all the upstream and downstream things
43:44
and I'm curious Sarah's is that a challenge for you as well?
43:48
Is there is there other sort of things that you see is like
43:50
these are the big Yogi's that are out there that we really
43:52
need to be aware of and manage against or for there are a lot
43:58
of them. Like I personally think identity
44:00
and access management is really a, it's a very nascent field.
44:04
Like we are the internet in the 1970s, right?
44:07
It's going to be so much better in 30, 40, 50 years and there
44:12
are so many big rocks that we have to move and so like too
44:15
many good ideas is one of the challenges of like you have to
44:19
say no to a lot of things in order.
44:21
To be able to prioritize the really big things and then the
44:24
other challenges, like okay. So you've got somebody new
44:26
coming onto the team, they've got to they just completed their
44:29
CS degree. They're really excited, they're
44:31
22 years old and you're like, yeah, we've got this five-year
44:35
project that's going to like change this little thing.
44:37
But changing that little thing is how we get to this bigger
44:39
thing. And like, you definitely want to
44:41
spend the next five years of your life on this, which is, as
44:43
far as they're concerned as like, 20% of their entire
44:46
lifetime, right? Like convincing them of that is
44:50
very challenging. Thing.
44:52
But I think it's possible, right?
44:55
If you are passionate enough and you can kind of explain that
44:58
this is, this is a really long term evolution that we need to
45:01
have in the field toward usability towards security and
45:05
it's not going to come easily and it's not going to come
45:07
quickly. It requires a lot of people
45:09
putting in a lot of hard work. Rome wasn't built in a day pass
45:13
wordless will not be built in 20 years.
45:15
It's like we've been trying to 10 years are probably another 10
45:18
years by the time. It actually you know comes
45:20
around but But the things that are happening now, in this
45:24
identity, spay in the industry itself, right?
45:26
The Advent of Pat's keys and things like the fight Alliance
45:30
and getting Apple, Google and Microsoft all to agree on
45:33
something, right? Those are momentous things.
45:36
And it is an interesting concept to say, Hey, you are solving
45:39
problem, you are working on problems.
45:40
That they, that may not be solved in your lifetime, right?
45:44
However, you define lifetime, whether it's literally, you
45:46
know, you'll be dead before. It's done, or your your With a
45:51
particular company, right? I'm sure there's people as they
45:53
yeah, I started this and, you know, it's been organized, five
45:56
years and here. So the end game that we're kind
45:58
of working toward and then they decide to move on and work on
46:00
something else. That is a very different
46:03
mindset. I think to have, and that sounds
46:06
challenging to me, especially with some stuff AWS works on
46:10
right. These are huge, big problems.
46:13
I don't remember the exact stats at the last time we chatted.
46:16
It was you get like, a ridiculous number of offend
46:18
occasion calls per second or per minute or whatever it was right?
46:21
Right. I don't think normal Enterprises
46:23
deal with that level of scale, and you're working on the
46:27
hardest problems and identity. And I would imagine that is
46:30
reflected in, you know, some of the personality of the work that
46:33
gets done for your team. Am I right on that or my
46:36
thinking about differently? Oh, absolutely.
46:38
Like in in AWS identity as a whole we authenticate and
46:43
authorize over 500 million API calls every second and that was
46:49
as of last year. You can see how much our revenue
46:52
is growing. Even in a recession here you can
46:55
kind of imagine how much our scale is growing in terms of
46:58
number of requests. And so the the amount of work
47:02
that has to be done just to keep things, smoothly running is huge
47:08
and then on top of that to really revolutionize the field
47:11
and say like and we need to rebuild this whole thing from
47:14
scratch and figure out how to do it better faster, more secure.
47:19
Like, that's all big rocks that need to, that need to move and
47:23
need a lot of passionate people. 500 million that is I don't
47:27
Ludacris as I'm just gonna leave that there.
47:29
I don't think I can. I can follow up on that one at
47:31
all a couple. Follow-up questions here is just
47:33
kind of the team aspect. No, we don't kind of running a
47:35
bit long and appreciate the time you spent with us.
47:38
How was this shift going from in person to remote you and I were
47:42
kind of talking the other day about sort of this transition
47:45
and sounds to me like you guys handle it better than most but I
47:49
think that's part of the culture and I want you to explain that
47:51
because I think this is something that I think is a
47:54
lesson that a lot of people can probably learn in the identity
47:56
space and managing identity teams of how you can maybe
47:59
replicate this. Yeah, one of the things that
48:02
Amazon learned in early days, was that it's really easy to
48:06
paper over sloppy thinking with PowerPoint.
48:09
And one of the ways that you can combat that is by all being in
48:13
the office together, right? And you're sort of batting ideas
48:15
around and you're saying oh yeah, no I didn't think about
48:17
that edge case, I didn't think about that.
48:19
This is actually a terrible idea, right?
48:21
But when your remote and you just have PowerPoint, it's easy
48:24
for those terrible ideas to kind of slip through.
48:26
And so we got rid of PowerPoint, all together internally, we
48:29
still use it externally. We use it for training stuff
48:31
like that. But when we have an internal
48:33
idea, a product design, an investment proposal, we always
48:37
write it down. And so we have this very
48:39
document heavy culture, everyone here is a very experienced
48:42
writer, and so when you go into an Amazon meeting, it's actually
48:45
silent for the first 20 to 30 minutes while everyone reads
48:48
through the Fire document. So there's no charismatic
48:52
presenter people with more Charisma aren't more likely to
48:56
get their ideas appearance and people with less Charisma.
48:58
You don't have people interrupting in the middle to
49:00
ask questions. Everyone reads the entire
49:02
document, and then everyone is aligned.
49:04
Unlike here is what we are discussing and you have all the
49:06
information. And now let's have a
49:08
conversation about it. And so, the transition to, to
49:11
remote culture was really fairly straightforward for us because
49:14
we have always had this culture of you need to write down your
49:18
complete thoughts, and As in all of the edge cases, and all of
49:21
the things that might go wrong as part of how you formulate
49:25
your ideas. And so that made it very easy
49:28
for us to switch to remote. So interesting to me because
49:31
that culture that you just described in a gave me a little
49:35
window insight and I'm wondering if that's Amazon or Silicon
49:39
Valley culture, you know, kind of tech company culture, but I'm
49:45
also thinking that for some people and probably for me, Me
49:49
like I might melt down in an environment like that, like it's
49:53
so different from everywhere. I've worked.
49:55
Have you run into people who just kind of meltdown or do
49:59
people kind of even if they're, you know, coming from like a
50:03
banking culture, they come in and they I guess I either fit in
50:09
or a Fallout right one or the other.
50:12
There's a little bit of that we try to select for it in the
50:14
interview process. We actually make you do a
50:16
writing sample as part of your interview so that we know that
50:19
Can you can communicate your ideas in writing competently?
50:23
But I would say, actually the people we see falling over the
50:26
most is not due to the document culture.
50:28
It's due to the ownership culture that we push ownership
50:32
very far down and the org chart so that each individual team is
50:36
making decisions about. Here's what we're going to build
50:38
next. Here's how we're going to do
50:39
project management. Here's how we're going to get
50:42
this thing out. Here's the order, we're going to
50:43
release things in and those decisions are vetted with upper
50:47
management but they're not. And by upper management, no one
50:50
has told what to do and so we have when we have director-level
50:53
people come in from other companies and other cultures and
50:56
try to like tell the team's, okay, we're going to work on
50:59
this, we're going to work on this.
51:00
These are your goals like teams are like this adorable.
51:03
That's not how we do things here.
51:05
Like we're the Smart Ones, we will tell you what we're going
51:07
to build next. And you can tell us like, if
51:10
it's a bad idea and why we can discuss it.
51:12
But like, there's no top down planning.
51:15
Yeah, yeah. So interesting.
51:18
I wonder you met, you Tension project management.
51:21
You know, I'm probably going to sound like a grumpy old man,
51:24
which I do, you know, a lot of times anyway, but I'm like a
51:28
waterfall guy. Like, you know, I just feel more
51:31
comfortable when I have the plan all laid out.
51:34
And I know step by step and then, you know, made career for
51:38
me agile. Really gate gain steam scrum.
51:43
And actually, I actually have a lot of respect for agile
51:48
methodology. She when it doesn't just become
51:50
an excuse to do without plan, I'm on my soapbox here, but I do
51:55
have a question. So, the question is, like, where
51:58
do you guys fit on the Spectrum, as waterfalls agile.
52:02
This is something in between, we actually let each team decided.
52:06
So we have a concept of what we call a to Pizza team, which
52:09
means that a team that's working on something.
52:11
Should be no larger than a team that could be fed with two
52:13
pizzas and so each of those teams gets to decide for
52:17
themselves, okay, we want to do We want to do scrum, we actually
52:20
want to do waterfall, like that's what makes sense for our
52:22
team for this project. So there's no top down
52:26
dictatorship about this is how you do project management.
52:28
It's up to each team to say, you know, this is what we have
52:30
experience with. This is what's working for this
52:32
project, this is what working for this team.
52:34
We're going to do a combination that the ink is whatever it is.
52:36
It's totally up to that. And it's, it's a little chaotic.
52:39
It's a little crazy, but it works for us at school.
52:42
Now, if you had Jeff and I on the team, I think you'd have a
52:46
maximum of four people on a team.
52:48
Half a pizza for each. Each what size pizza we talking
52:55
about here and you get the most important thing, right?
52:57
Exactly. Exactly.
53:00
I did also just was wondering little bit of the inside
53:04
baseball for Amazon or you know at AWS.
53:09
Do you guys have a lot of shared services?
53:12
Sounds like a lot is team Centric but I'm wondering do you
53:16
have sir? You know shared services like
53:19
You know, testing center of excellence change, Advisory
53:23
Board service desk. Things like that that you
53:26
incorporated into your projects or do you guys try to be
53:30
self-contained for most of those things?
53:33
It depends we have. We had a lot of things that are
53:35
distributed. We have some things that are
53:36
centralized, one of the ways that we try to make those
53:39
decisions. As a product, is if we have
53:42
someone on the team, are they going to have people to learn
53:46
from? Are they going to have a ladder
53:48
up in their career, right? If we only need one usability
53:51
person on that team, who's that person going to learn from
53:54
right? How are they going to get
53:56
promoted where they gonna go versus?
53:58
If we centralize all the usability people and we say okay
54:00
you guys are all one team. You work for all the teams and
54:04
you do all this distributed work but you get to work together
54:08
with other people who are doing what you're doing, like that's
54:11
that makes more sense for us. So it really depends how many
54:15
people you have. And whether they have people,
54:18
they can learn from All right, we've been running long and I
54:22
think, I think it's cool how you've kind of incorporate this
54:25
into sort of, like, your plan. So I want to start to wrap
54:27
things up. We always end on a lighter note,
54:30
and we came up with a couple actually Sarah.
54:33
So we're talking about this beforehand, kind of how we're
54:35
going to work through things. And the idea here is I would
54:39
like you as of Wednesday, February 8th, which is one
54:42
recording, this this will go live.
54:44
February 13th, I think on Monday at some point described.
54:49
Your current state using either emojis or meme or GIF or
54:55
something like that. Now remember this is an audio
54:57
podcast so you have to be as verbally descriptive as
55:00
possible, so people will be able to follow along, okay, so
55:03
there's a gif of Kermit the Frog and he's like, waving his hands
55:08
in the air and screaming because he's so excited and like that's
55:12
how my life is right now. Like everything is chaos but
55:15
it's super exciting. Right there is so much going on.
55:19
Is going to be amazing. That it will all come together
55:22
and it will be great. That's a really good one because
55:25
I immediately knew what you were talking about.
55:27
Ha, ha, ha ha ha got along at home gym, about yourself.
55:31
How you going to describe your current state using an emoji?
55:34
A meme, a gift, something like that, c-czar's day Optimist.
55:38
And like you said, let's start the podcast off on a good note.
55:42
I'm looking at it. Like I'm like, yeah, super busy,
55:45
too, but I'm not doing a happy dance.
55:47
So my current Estate would be the meme.
55:50
Ain't nobody got time for that. I just feel like, you know, it's
55:54
like people want to get me involved with doing this.
55:57
That and the other thing I'm like my plates already full.
56:02
It's overflowing but so yeah. And then you push it over to me
56:06
and then I take care of it. That's what I, you ain't got no
56:09
time for that either. I'm here to help out as much as
56:11
I can. I like that one, too.
56:14
You know, I was thinking about one earlier and right now, I'm
56:18
going to change it on the Because I feel like I'm very
56:21
fortunate as we've been talking about identity teams, I work
56:23
with some really good smart people and the the GIF that I'm
56:28
going to go with is it's gift, not GIF.
56:31
So, don't even come at me, bro. With anything.
56:33
Any of that, that that pronunciation is from the movie
56:38
Analyze. This, where Robert De Niro is
56:41
talking to Billy Crystal and he's like, you, you are good,
56:45
you got a gift, my friend. And he's like pointing as I
56:48
know. Yes you are.
56:49
Are your good. And I think about this the
56:51
really smart people I work with then Trini Ross, Robert Selena
56:56
yourself, Jim. You know, it's people like that
57:00
that really kind of get the real work done in the team, and I
57:02
feel very fortunate to be kind of surround with that.
57:04
So I use that gift today with someone who is helping me with a
57:07
contract. So you know, that was my way of
57:11
communicating, I feel like I'm I am meme and GIF, first English,
57:15
Second Language as the way I approach it, but that's how I
57:18
feel. Now is I just feel like there's
57:21
so many good people and try to give them recognition wherever I
57:24
can. Okay, Sarah.
57:27
I got one more question for you. I was trolling your Twitter
57:29
account and I think it was earlier this year, you mentioned
57:34
something about a chaos button and I am fascinated to find out
57:38
how this works, tell me about the chaos button.
57:41
So somebody posted a picture of a microwave where like the
57:46
controls for the microwave had been translated into honorable
57:49
English and the My Grave has a chaos button on it and so we
57:55
were kind of speculating about like what is that mean like can
57:59
we just put a chaos button and everything?
58:02
And so my new goal is like every product that I work on is now
58:05
going to have a chaos button and it turns out that it was
58:08
actually defrost because in defrost like all of the
58:11
microwave raised go to different places in the food so that it
58:15
can get uniformly, warmer something like there is a reason
58:19
Hidden behind the chaos. But now I'm just like, when you
58:22
want to set your password policy and Amazon Incognito it's going
58:24
to be like do you want to require uppercase?
58:26
Do you want to require lower case?
58:27
Do you want to require numbers or do you just want chaos?
58:32
It's everything. I hope more identity vendors do.
58:35
This is like a Easter egg within like their settings somewhere.
58:37
It's like yeah, it's a radio button inside of I'll sail point
58:41
or saving, or OCTA, or Cognito, or maybe is like click this
58:45
button, and it totally scrambles all your settings and your
58:47
tenant or something like that. Exactly.
58:50
I love the idea. I think we need to find more
58:53
ways to incorporate the chaos button.
58:55
So I am I'm hopeful that we'll see it somewhere and maybe some
58:58
documentation. I don't know if it's no good,
59:01
making him say WS, documentation any point, but if you spot it, I
59:04
guess what? Sarah.
59:05
No. That's why is I'm guessing.
59:08
All right. Why don't we go ahead and wrap
59:09
it up for their Sarah. You're always so generous with
59:11
your time and you are such a good speaker.
59:14
I always enjoy, you know, seeing you present and listening to
59:17
your stories that you tell on Agent stuff like that, so I'm
59:21
glad that you keep doing it. Despite people saying not to do
59:24
it, those people are crazy, keep doing it because I think there's
59:26
a lot of value that you had out there to just the identity
59:28
ecosphere, especially the ID Pro stuff, we got to get more people
59:31
involved with that. It's such a great resource,
59:33
we'll have a link on our show notes, ID Pro dot-org is I think
59:37
it still $150 for a normal membership?
59:40
It is on the price. I don't know.
59:42
Okay. Like, hands down, like the best
59:45
thing you can buy for yourself, or ask your company, too.
59:49
Expense it. It's a total no-brainer just
59:51
just for the slack Channel alone and having access to all those
59:54
people and stuff like that. So Shameless plug we don't do
59:56
commercials but we are big supporters of what Ida Pro does.
59:59
So so we'll have that in our show notes.
1:00:02
We'll also have a link to Sarah. Do you want to ask her
1:00:04
questions? Chaos button, advice on teams?
1:00:08
I don't know, whatever Cognito I guess, maybe.
1:00:11
Whatever might be, we'll have a link to her on LinkedIn that
1:00:13
people can reach out and connect with, as well as Jim and myself.
1:00:17
We are on Web, idac. Podcast.com we're on Twitter at.
1:00:23
Idac podcast, we're on Mastodon, which is at idea podcast at
1:00:28
infosec that exchange S8 every week, but I hate the way Macedon
1:00:31
does because they're naming structure.
1:00:34
It's not easy to use and needs to get better and I am very
1:00:38
happy. Also, again, plug for the
1:00:40
Gartner stuff that we're working on, send us your hard questions,
1:00:44
and if you don't want your identity known on the post that
1:00:46
Jim put out there, sent it to me.
1:00:49
I will, you know, will invoke like the journalist rule right
1:00:52
of not not doing the sources, Jim will send, you will get your
1:00:55
address and send you a sticker and, you know, stuff like that.
1:00:58
So we hope to see people at the Gartner.
1:01:00
I am Summit in March, a lot of friendly faces and I'm we're
1:01:04
looking for hard questions, so don't be shy.
1:01:06
Let's, let's really put it to them and see what we can get
1:01:09
away with, as we work through, you know, that process.
1:01:11
So, Sarah, any final words of wisdom before we let you go.
1:01:15
No, really great to talk to you guys on the episode 200, 200
1:01:20
next. I have no idea where we're going
1:01:21
to do, we will figure it out like we always do.
1:01:24
All right, thanks, everybody for listening, we'll talk with
1:01:26
everyone in the next one. Thanks for listening to a
1:01:33
podcast. If you like what you heard,
1:01:35
don't forget to subscribe and visit us on the web and identity
1:01:38
at the center.com.