Latest / Identity at the Center / #348 - The Identity Data Dilemma: Martech, Adtech, and IAM with Eve Maler

Transcript

#348 - The Identity Data Dilemma: Martech, Adtech, and IAM with Eve Maler · Identity at the Center

0:00
What I chose to do for the South by Southwest audience was, you
0:04
know, I talked a little bit about zero Trust and how they
0:06
say assume breach, right, which is a good assumption for both
0:09
people and organizations. I suggested as well, they need
0:14
to start assuming tracking. So assume breach, yes, assume
0:19
tracking, absolutely, which is, you know, that's not a piece of
0:25
advice that's sort of actionable other than making you think
0:28
before you share things you don't want to get out there.
0:31
You know, the other joke that might be made, and especially
0:34
given where Identiverse is held these days, you know, what
0:37
happens on the Internet stays on the Internet.
0:41
So, so like being aware is sort of the first thing in terms of
0:44
doing something about it as an individual that can be really
0:48
tough. There are things you can take on
0:52
board that require some friction in your life to do, and that's
0:57
not something I generally want to ask people to do when it
1:00
comes to identity professionals and what we can all do to
1:04
support the efforts to give people more choice, give people
1:09
more transparency when they are consumers of businesses and when
1:11
you work for those businesses. I think we have to, you know, if
1:14
we take ID Pro's vision seriously, we have to try it and
1:18
do that. And that requires understanding
1:21
the value that is being created for the business of each of
1:24
those pieces of data. So when you were talking about
1:26
data governance, Jim, I totally agree.
1:29
The way that a privacy professional would see that is
1:32
it's kind of a risk assessment for each piece of data
1:34
collected. What I think we've been
1:36
forgetting is the value assessment.
1:43
This is identity at the center if it has anything to do with
1:49
IAM. This is the go to podcast now
1:55
your hosts Jim McDonald and Jeff Stedman.
2:03
Welcome to the Identity of the Center podcast.
2:05
I'm Jeff, and that's Jim. Hey, Jim.
2:07
Hey, Jeff, how are you? Oh, not so bad yourself.
2:10
Doing great. So I've got a theory I've been
2:12
working on, which is that we are at a current point, which is the
2:17
widest gap between laggard I am and next Gen.
2:24
I am. So we got Yvonne today as
2:26
everybody knows, right? It's in the title of the of the
2:30
show surprise. We're going to be talking a lot
2:32
of next Gen. stuff. I think every once in a while
2:38
we're like, we've run into a project and it's something like,
2:43
yeah, the way we do access is we've got this Word document and
2:48
we fill it out and it says make Eve like Jeff.
2:52
And then we just do that. And you're just like, oh boy,
2:56
you gotta be kidding me. And I think we're at the widest
3:00
gap. I think that that first scenario
3:02
isn't really that far from what you'd find maybe in more places
3:06
20 years ago, but now the the next Gen. is non human
3:13
identities, it's the decentralized identity.
3:20
So there's all these new areas that are cropping up and it's
3:22
getting more interesting and like how does this all this new
3:25
technology fit into what we're doing?
3:29
But there's unfortunately still organizations that are
3:32
struggling with that basic blocking and tackling.
3:37
So, OK, so I think I know where you're going with it.
3:41
I don't know if I agree though, only because you and I in our
3:44
day jobs, we see pretty much the worst of I am right, you don't
3:47
call identity consultants and things are going great, right?
3:50
It's like all I need help with something and a lot of the
3:52
companies that you and I deal with, would you, I don't know if
3:56
I would call them laggards. I would call them average as far
3:59
as IA maturity goes, because there are still a lot of
4:02
organizations, too many that still haven't made investments
4:06
that I would call like basic IAM technologies.
4:09
And I think of things like identity governance, you know,
4:12
to help with automation and things like that.
4:14
And I think of, you know, privileged access management
4:16
tools. And then, you know, I think the
4:19
most investment that's happened over the last five to 10 years
4:23
has really been more on the authentication side, especially
4:25
when COVID hit, it was like, wow, everybody's working from
4:27
home and remember how we didn't have MFA.
4:29
Well, we'd better sure have it now.
4:31
So let's get that rolled out. And so I think authentication
4:34
has sort of become relatively standard, but I don't know if I
4:39
would call laggard and next Gen. just knowing how many companies
4:43
haven't even caught up to the what we what you were kind of
4:46
referring to as like the laggard part.
4:48
I think that's pretty average. It's far rarer that I see like
4:51
next truly next Gen. I am, and I don't mean like a
4:55
fancier IGAI. Think of things that are more
4:57
like API based. They're using things like shared
4:59
steel framework or Cape or, you know, other types of
5:02
orchestrations that are almost UI less.
5:06
It's it's orchestration, it's policy based, it's adaptive,
5:10
right? And it's using data rather than
5:13
and just another way to collect a form on somebody, whether it's
5:16
a word form or a ServiceNow form or whatever it may be.
5:19
Like I see getting rid of that touch point as really sort of
5:23
the next Gen. and then using the data off that to do policy based
5:26
decisions, risk based decisions, right?
5:28
Things like that. Yeah.
5:29
I think that you're right about the authentication piece.
5:32
I think that's where a lot of organizations have put their
5:36
investment. I think that by laggard, you can
5:39
say laggard in terms of investing in other areas that
5:43
are also important. Privileged access management in
5:46
terms of user management in terms of, you know, on the
5:50
external side where you have a lot of people trying to
5:54
penetrate. But I also think when you talk
5:57
about some of these next Gen. things like non human identity
6:00
management, when like like decentralized identity, you
6:03
can't even worry about those things until you get the basic
6:06
blocking and tackling done, right.
6:08
Well, you could worry about it. I don't know if you can do
6:10
anything about it, but you can certainly worry about it, that's
6:11
for sure. But let's look non, you know,
6:14
NHI non human identity, right? It's it's sort of like the
6:17
identity topic du jour for the year 2025 and probably towards
6:21
the end of 2024 is when it first really kind of got into the
6:23
limelight. But it's not new.
6:25
Non human identities have been around forever.
6:27
I mean, there's service accounts that have been around forever,
6:30
you know, go back as far as the mainframe, right?
6:32
And I'm sure even before that, right punch cards, you know,
6:35
probably had some of that too as well.
6:37
So when we say non human identity, I think all we're, I
6:40
think what we've started to do is recognize that these
6:44
identities do need to be managed as well, whether they are a
6:49
carbon based life form behind it or not, or if we want to, you
6:52
know, debate the semantics of account versus identity.
6:56
The problem is not new. It's almost like saying, well,
6:58
identity's the new perimeter. It's been the perimeter for like
7:01
25 years, 30 years. So it's just, it's, it's getting
7:04
hot right now, which is cool. Like, Hey, I'm not going to
7:06
knock it. Like that's great for people in
7:08
the IM space, but I, I, I don't, I don't know if I agree with
7:12
like that's like the future. I think it's the now and it's
7:15
the has been, not has been. That's probably what I want to
7:17
put it, the history, but I hopefully that makes sense.
7:21
I'm not saying it goes away. It's definitely going to be part
7:23
of the future as well though. I, I kind of feel like non,
7:27
you're right in terms of non human identities have been
7:30
around for as long as we've been in IT, but the problem has
7:34
grown, right. So there are more devices on the
7:37
network. The device has more importance
7:41
in terms of the overall authentication picture, for
7:45
example. So there's the device side of
7:48
it, but then there's also the workload side of it, which I
7:50
think you referenced. Sure, you have service accounts,
7:53
but you also have robotic process automation.
7:56
You also have people doing things with like Kubernetes and
8:00
Docker and infrastructures code and, you know, managing your
8:06
cloud environment. And so when I start to think
8:09
about those things, look, if you have an organization that's like
8:13
using word forms and copy as are you probably doing a lot with
8:16
Docker, well, I don't know. There might be other people like
8:19
we put our money there. We want to make our
8:22
infrastructure hum, or we hire somebody who's like a whiz kid
8:27
and they're going and doing those things.
8:30
And they might be wearing dockers.
8:31
So there you go, there's your docker container.
8:33
There you go, you pulled it all together right there.
8:36
I think I know where you're going with it.
8:37
Like, OK, yeah, I mean, that makes sense.
8:39
I just, it's like, I think sometimes we forget about the
8:44
average population. And I don't mean that
8:47
negatively. I mean where most people are
8:49
from like a company perspective, a maturities protected, a very
8:52
capability perspective. There's just a lot of companies
8:55
that are still kind of scraping by.
8:58
And I mean, you and I know this, right?
9:00
We talked to a lot of really smart people, like, yeah, they
9:02
know what they should be doing, but they don't get the funding
9:05
to do what they want to do. Or, you know, their strategic
9:07
investments just aren't there yet to, like, modernize or
9:10
improve things. And it's painful.
9:11
And that's why I refer to all these I am heroes out there that
9:14
literally make the company work through sheer effort and will in
9:18
spite of, yeah, I have to send a fax to get an account to me.
9:23
I mean, like, it's 2025, but that still happens.
9:26
It's crazy. Yeah, so I'll be interested to
9:29
hear what Eve has to say. Is the this chasm or this gap
9:33
between laggards and next Gen. I am.
9:36
Is it worthy of a Venn chart? We'll find out.
9:40
I, I, I mean, we, we, we probably already know the answer
9:42
to that. So for sure we're recording this
9:45
a little bit advance. I'm going to tear it on the 4th
9:47
wall a little bit. We have not yet gone to EIC, but
9:50
we're trying to make sure we have content to kind of carry
9:52
over EIC and our vacations and things like that.
9:56
So for people who are listening, just know that we are still yet
9:59
to go there and, and he's been gracious enough to join us and
10:01
give us kind of a preview of, of what she's going to talk about.
10:04
But don't forget we still have an Identiverse discount code.
10:07
We're going to be there. We're going to be just doing
10:09
some cool stuff. So if you visit us there in Las
10:12
Vegas, June 3rd through the 6th, if you use the code IDB 25-I D
10:16
AC25 to get you 25% off, it'll be in our show notes.
10:19
And it's also on our homepage, IDC, podcast.com.
10:22
If you just Scroll down and it'll be right there.
10:24
But the cool thing we're doing and and we've started to, to get
10:27
this out there is we are bringing the Identis Squabble
10:30
game show to the Identiverse Conference.
10:34
So if you are familiar with what we put on at the Authenticate
10:37
conference late last year with their help, we are, we are
10:41
rebranding it slightly at least for the identity of the Center
10:44
to Identis Squabble. I'm going to be the MC slash
10:48
game show host and Jim's going to be a team captain and I think
10:52
we're going to do IDAC versus ID pro.
10:54
So I think we've reached out to Heather and she seemed to be in
10:57
for it. You guys are going to pick your
10:59
own team mates. Neither of you will be able to
11:01
see the questions in advance. Only I have access to that.
11:04
So I'm creating a a list of identity questions, non human
11:08
questions, and maybe some Vegas questions to kind of keep things
11:11
fun. We'll probably have time for
11:12
maybe 3 or 4, but we're going to be kicking off the Expo sort of
11:15
reception party that Tuesday night when things kind of open
11:18
up for that kind of stuff. So I'm looking forward to that
11:21
and hopefully people will come out and see that.
11:23
I'm trying to make it also a little more audience
11:25
interactive. So maybe we'll have like life
11:28
lines that we can do where, you know, if people aren't sure of
11:30
answers, they can ask the audience, right?
11:32
Or things like that. So I'm very much looking forward
11:34
to that. Jim, do you have your teammates
11:36
lined up yet or are you still working on that?
11:38
No, I still have to work on that.
11:39
So I I mean, you just announced news that I wasn't even aware
11:43
of. So Heather has agreed to be Team
11:46
ID Pros captain. I mean, yeah, you should check
11:49
your e-mail. Well, I'm hey man, I've got some
11:51
other things going on. Sorry.
11:53
There is nothing more important than I, Dennis.
11:55
Squabble, Jim. This is the most important thing
11:57
happening in the entire world in the next, let's call it month.
12:00
Two months. I know.
12:01
Not just for me, I mean for the entire world.
12:04
Exactly. Yeah.
12:06
So I'd AC versus ID pro. I think I reached out to Eve and
12:10
I think that she's not going to be there, right, Eve?
12:15
I'm going to be there for a little while.
12:17
I'll probably have to miss Identisquabble, but I really
12:20
like saying identisquabble. Yeah.
12:22
Can I just say? I don't know if there's any
12:24
reason to go to the conference if you're going to miss
12:26
Identisquabble, but I'm just saying I'm.
12:30
Sorry to miss that part. I want T-shirts out of that
12:32
though. There ought to be T-shirts.
12:34
There should be T-shirts. Well, maybe we can make it a
12:37
recurring thing. And, you know, we'll see.
12:40
We'll see what we can do. It's fun.
12:42
You're not going to learn anything, but you're going to
12:43
have fun and be entertained. So that's kind of the point of
12:46
it. All right, let's let's formally
12:47
introduce Eve. She's a digital identity
12:50
futurist and strategist. She's the Co inventor of XML,
12:54
SAML, UMA and maybe other things that I'm not aware of.
12:57
Privacy by design ambassador. She's a board member.
13:01
She's one of the IM rock stars of the band ZZ off.
13:05
She's the president and founder of Ven factory and this is her
13:08
seventh time on the show. Welcome back, Eve.
13:12
It is a delight and a mystery at the same time.
13:17
That's how we like it on here. We don't know what we're doing.
13:19
Seventh time on the show. I think I mentioned before we
13:22
hit record that you're approaching Andrew Shikiar, A
13:24
Fido Alliance fame, who I think is the current record holder.
13:28
I'm sure we'll get Andrew on later this year as we kind of
13:30
get closer to the Authenticate conference.
13:31
But you've been very generous with your time.
13:34
You are actually. And and Jim talks about this
13:36
royal time. I don't know if he's ever
13:37
mentioned it to you. You're like our first big get
13:40
for the show and we were so excited.
13:42
It was like, Oh my gosh, like Eve wants to do the show.
13:44
Like does she know who like what we're doing?
13:47
And, and you probably do and that's fine, but you're you're
13:49
very generous with your time and joining it to us.
13:51
We'll never forget that. It was kind of the ones like,
13:53
oh, you actually could get some people on this show that people
13:55
have heard of. You had all the signs of
13:57
greatness even then. Well, flattery gets you
14:00
everywhere in this show, so, you know, I'll take it anytime we
14:02
can get it. It was October the last time you
14:05
were with us and I think actually you recorded maybe that
14:08
one with Jim, because I think I was travelling.
14:10
And so we've been kind of talking about things in there.
14:11
But I'd love to understand what's new in your world since
14:14
the last time you were on back in October.
14:16
Gosh so much. I mean you know I've been
14:20
growing ven factory. I've got some exciting new
14:22
clients preparing 1/3 white paper that I've written with a
14:26
co-author for the first time. We're hoping to launch it in a
14:32
kind of an e-commerce site that I I'm working on putting up and
14:36
I got this great opportunity to go speak to South by Southwest
14:39
about identity. That is so cool.
14:43
I mean, how how crazy is that to have, you know, like an identity
14:47
talk at South by Southwest. I joke about like, hey, they
14:49
should make a, you know, let's turn ideas into a Netflix show.
14:51
But I mean, that's pretty close to the same kind of concept,
14:54
right? I mean, what was it like being
14:55
at South by Southwest? It it's fun.
14:57
It was fun for sure. I did have an experience like 10
15:01
years ago where Joni Brennan was involved and a few other folks
15:04
from the identity world. We were talking about IoT
15:07
privacy back then. And so they've had some
15:10
representation of, you know, great tech topic topics over
15:12
time. But like, I wanted to be sure to
15:15
reach a whole bunch of folks who might not have identity context
15:19
at all, even though they said, you know, don't be too high
15:22
level, you know, I, I didn't want to leave people behind, you
15:26
know, So, so I really just tried to cover why individuals should
15:30
care, why businesses need to care and provide advice for
15:34
everybody. So yeah, I had that opportunity.
15:36
It was it was awesome. And, and just being in the, you
15:38
know, the zeitgeist of South by and walking around Austin with a
15:41
bunch of other folks hearing music from every corner that,
15:44
you know, it doesn't suck. I mean, that's totally like
15:46
Rockstar, you know, mentality, right?
15:48
At that point, it's like, all right, we're going to hear from
15:50
Eve, but I am. And then here comes this major
15:52
band. I'm somebody I actually
15:54
recognized from the movies walking down the street.
15:56
Yeah, it's kind of like that. I love your website.
16:00
I think it's fantastic. It's one of the one of the more
16:02
well designed ones that I've they've come across.
16:04
I want to know how do I meet the star of Ven factory.com?
16:08
And by that I mean your adorable puppy or dog that is in your
16:12
like, welcome video. Sabrina.
16:15
Yeah. You know, she's way more popular
16:17
than I am. I should have had her join me
16:19
today. I'm happy to introduce you to
16:23
She cares about about identity, but she doesn't know why.
16:28
Now, did she have a rider to get into that video where they're
16:30
like, you know, only carrot biscuits and green beans or, you
16:34
know, something like that? Like, what was the what was her
16:36
union rate to have her, you know, be the talent on air?
16:40
Extra TREATS, basically. That's right, you can't say the
16:44
word out loud because it'll. Summon well trained yeah you're
16:46
CAMP you can't say WLK I'm. Flying in, you're like treats.
16:50
Do we hear treats? No.
16:52
It's a great website. I encourage people to go check
16:54
it out. I love the video.
16:54
Anytime I think I see a dog on camera with like, people, it's
16:57
like, all right, yeah, I'm in. Sign me out.
17:00
Who doesn't love dogs and who doesn't love Venn diagrams?
17:03
So the answer to your question before is yes, of course.
17:05
I'm sure there is some sort of chart that can be made.
17:08
Is it a is it a Venn diagram when the circles completely
17:10
overlap? I mean it's like who loves dogs
17:13
and Venn diagrams? Like it's the same people.
17:17
I mean, there is that ID pro Slack channel that's all about
17:20
Identi pets. So, you know, I think there's
17:23
probably a pretty good close to to overlap, perfect overlap
17:26
among the populations. I will say this though, so if
17:31
you show me the the latest Venn diagram that you're working on,
17:34
it looks different. It wasn't like 3 intersecting
17:37
circles, right? It's kind of like a.
17:39
Correct. I don't know, it looks.
17:42
More like a. It looks more like a, I don't
17:45
know, Sr. 71 Blackbird kind of shape.
17:49
Now you're speaking my language. Yeah.
17:51
Blackbirds are an awesome jet. Yeah.
17:53
I used to have a poster of that on a wall at one point.
17:55
Yeah, they're pretty, pretty cool.
17:56
Icky. Yeah.
17:57
It turns out you can't do sets if, if you're comparing sets and
18:03
you have more than three sets that you want to compare, you
18:06
can't use circles. It's just sort of impossible.
18:10
So you either have to have sort of rounded ellipses or you have
18:13
to have kind of blocks, or you can be more creative than that.
18:17
And so it's a four set then, because I'm comparing 4 things.
18:20
And it's all about kind of stakeholders and reasons to do
18:25
identity. And you know, I, I, I think
18:27
there's four basic reasons to do identity.
18:30
And the problem is everybody in the organization, not to mention
18:33
just regular human beings who who have a stake, who care in
18:37
the results. So is this research that we'll
18:41
see at some point, like where's this in the life cycle of the
18:44
generation of it? Yeah, You know, I shared an
18:46
early version of it I think at EIC previously and I've done
18:49
some more work. It's definitely going to be in
18:52
the EIC talk. So you know, people who may be
18:54
watching this afterwards will have seen, but I'll be sharing
18:57
it from stage. It's turning out to be very
19:00
productive for me to be able to see what advice that I can give.
19:04
Not just tech vendors about like well, who's your buyer persona
19:08
kind of thing, but also enterprises around how to make
19:13
sure that you have the right representation and have the the
19:16
highest bandwidth possible conversation around, you know,
19:20
who who cares about the outcomes and how to succeed and how not
19:24
to have somebody working against you, perhaps accidentally or
19:27
perhaps not. Accidentally.
19:30
I mean, that's the kind of stuff that I think people eat up
19:32
because I mentioned I am heroes early on.
19:34
And you know, the, the, the, the sad and unfortunate truth is
19:38
most of us are operating underfunded, under resourced.
19:42
Like there's just so much that needs to get done.
19:44
And so anything you can do to, you know, help convince the
19:47
right people to say this is an investment that is worthy.
19:50
Yeah, as much information you get on that, it's not going to
19:53
be the right answer for everybody, right?
19:54
But I think that the more inputs we get into that, you can take
19:57
this out if you're listening and shape your message to whatever
19:59
is most appropriate, you know, for your organization.
20:02
So. Totally.
20:02
And you were talking about sort of laggards versus next Gen.
20:06
You know, there's a lot of pull by clever people, innovators,
20:11
you know vendors who are trying out new solutions.
20:14
There's a lot of pull towards stuff that is just completely
20:16
new and it's hard to absorb. And, you know, I've spent a lot
20:20
of time, you know, working with kind of the sell side.
20:23
And, you know, this is not meant to be pejorative towards
20:27
anybody. But like, I think vendors live
20:30
in the future because they've got to do that pull.
20:32
They have to imagine, you know, what went wrong and how to solve
20:35
it. And they have to kind of be out
20:37
there and enterprises live in the past.
20:40
And it's not sort of a bad thing.
20:42
It's more like, you know, if you think about the population of
20:45
cars, I don't know in any one country in the US, there's going
20:48
to be a distribution of ages of those cars, which is one of the
20:51
things that makes connected car and IoT hard.
20:55
Same thing with enterprise infrastructure.
20:57
It represents buying decisions, you know, of 20 years, of 50
21:02
years, of 100 years. So of course the average age of
21:05
that stuff is going to be older and it's why you have to deal
21:07
with legacy and have Shim APIs and all the rest of it.
21:10
So it's just the nature of the thing.
21:12
And that's where you get a lot of overlap too, like you're
21:14
trying to buy a product that is future facing, but oh by the
21:17
way, can it also support COBOL or Rack F?
21:21
Totally. I mean, I think there's been
21:22
some move off of AS4 hundreds, you know, among the banks over
21:26
time, but not 100%. Right.
21:28
I still see tons of insurance companies using, you know, a
21:30
mainframe in the basement runs their entire operation.
21:33
And it's, it's, it's crazy how much how, how much some of these
21:36
technologies have just lived longer than they probably should
21:40
have, but they do because they are serving a purpose.
21:42
And there hasn't been that key reason like, OK, now we've got
21:47
to go. Yeah, yeah.
21:48
This is the conversation that often happens about, you know,
21:51
are you selling vitamins or a painkiller?
21:53
And you know, if there's some big pain, OK, well, now there's
21:56
a motivation and you can effect change and take care of tech
21:59
debt and do all the rest of it. That's such a good analogy.
22:02
And hopefully they're like Flintstone vitamins and they
22:04
taste good. I know we want to get into the
22:07
EIC talk you're going to give here, but I do want to ask you
22:09
about an earlier conversation we had way, way, way back and that
22:13
was around like personhood credentials.
22:16
Any news in that area that that we should be kind of picking up
22:19
on? From my perspective, there's a
22:21
couple of interesting things. First of all, I'm seeing more
22:24
and more folks who are in the verifiable credentials game.
22:28
Also the biometrics game offering personhood kind of
22:33
services, right or personhood credentials delivered into
22:37
wallets. So I'm starting to see that
22:39
there's some uptick in, in adoption around that kind of
22:44
technology. The other thing that I've been
22:46
noticing is along with Dean Sachs and Mike Kaiser, I'm kind
22:52
of, I call myself the junior Co chair of the three of the the
22:56
death of the digital estate group, the Dade Group.
22:58
And we've been having kind of an interesting conversation around
23:01
do you need personhood information about somebody who's
23:05
passed away? So you know, we talked about is
23:08
a person. So I guess that sort of was a
23:10
person, you know, really did have a real world presence.
23:13
And these are things that are hard to solve because you're
23:16
not, not to be crude about it, you're like not doing liveness
23:19
detection in that case, right? So these are important pieces of
23:23
information. And what we've been learning
23:24
about kind of like the, I guess, looking at the government agency
23:27
infrastructure of the world around, like how do you sort of
23:31
inform important other downstream services that
23:35
somebody has passed away? Like it's, it's by no means a
23:38
clean system with good data. It's, it's a mess.
23:41
So those are some of the considerations that are that I'm
23:44
sort of coming across as I look across the landscape.
23:47
So it's interesting that that that viewpoint of is a person is
23:51
in current tense, was a person as in past tense, which leads to
23:56
me there is a also probably going to be a will be a person
23:59
as in future tense. So how do you manage something
24:03
that is past, present and future?
24:05
And I guess what does personhood mean?
24:08
Like can you define that? Is it as simple as it's a human
24:11
being, or is it beyond that? There's different levels of what
24:15
kind of information can be delivered about this notion. 1
24:19
The most obvious to us, you know, having been in the
24:21
industry for a long time, is kind of full identity
24:24
verification. So you're saying it's not just a
24:26
random person, You're saying it's a person who really lives
24:29
in the real world and this person presenting this
24:31
credential matches to that known real world person.
24:35
That's identity verification. It's a kind of is a person, it's
24:38
just very specific. There are other levels where
24:41
it's more like this entity in front of me trying to operate
24:45
this service or this application is is really alive, is really
24:55
operating it in the moment, which is, you know, on the other
24:58
end of that continuum and sort of in the middle is things we
25:02
see with like age assurance where you're doing age
25:04
estimation that's a kind of is a person of a particular category.
25:09
And so wherever you have things like age restricted purchases,
25:13
you know, there's laws around age restricted purchase of a
25:16
whole bunch of different things. In fact, in my South by
25:18
Southwest talk, I was showing how, you know, one state is, is
25:22
thinking about age restricting skin care.
25:24
Another one is age restricting, I don't know, other beauty
25:27
products. It's kind of weird.
25:29
So, so you can ask, you know, is a person older than 18?
25:33
It's kind of a species of personhood because it's less
25:36
specific than anyone in particular.
25:39
Does personhood extend to non persons?
25:43
So this idea of, you know, AI and agentic AI and all these
25:47
other bots and service accounts and non human identities, I feel
25:51
like there should be a way to verify those credentials as
25:54
well. So yeah, this really is the Venn
25:57
diagram AI versus the, you know, XYZ application, whatever it may
26:01
be. Is there a space for non
26:04
personhood in addition to personhood?
26:08
I could swear that one of Dave Birch's newsletters had one of
26:11
those wonderful cartoons about this, like, you know, swear
26:14
you're a bot or something. And that's, that's kind of, I
26:18
mean, we'd call that attestation right in the IoT world or device
26:22
or, you know, other non human entities.
26:25
And attestation of something is, you know, it's definitely a
26:29
thing. And I, I, I think it could be
26:30
valuable. You know, we have software
26:32
statements and things like that that we can use to assess
26:36
whether it's really the client app that we thought it was, for
26:39
example. So I think that it does
26:41
generalize across beyond humans, although as usual human versus
26:46
non human, say authentication, it's going to look different and
26:49
care less in the non human case about user experience.
26:55
So good. Let's talk about your EIC talk
27:00
at one-on-one level you're talking about stakeholder
27:03
management, which you know depending on what you're into
27:07
that might not sound super interesting, but you're really
27:10
talking about it in terms of this application in customer IM,
27:15
which I think, OK, that all starts getting interesting
27:18
because you're talking about these all these different
27:20
stakeholders outside of the technology space.
27:24
And even more than that, you're focusing on this space called or
27:29
these spaces called martech and adtech.
27:33
So all this starts to make you get really interesting really
27:36
fast. Let's start with what are
27:39
martech and adtech because those might be new terms for people.
27:43
Yeah. So martech is a very important
27:45
tech stack that marketing folks run.
27:49
And I would say the basis of it is kind of marketing automation,
27:52
the ability to send out all those messages to, you know,
27:57
that are personalized, that get people to buy, that get people
28:00
to go on to the buyer's journey. We've all experienced this.
28:04
Often times we talk about it from the privacy perspective of
28:06
being sort of stocked. But of course, a lot of us also
28:10
welcome this personalization in these digital products, in these
28:14
experiences. So martech is marketing
28:17
technology basically. And so anybody who's ever, you
28:21
know, in a Siam circumstance, you might have had to connect to
28:23
marketo and there's a whole bunch of, you know, folks who do
28:27
what they do. That's part of it.
28:29
Adtech is where you get into the, the data, data brokering
28:35
marketplaces of the world, the things that make you be tracked
28:39
with cookies or other similar technology and have you as a
28:44
kind of heuristic fuzzy picture of a human, be presented to
28:48
these systems so that they can call it retargeting.
28:52
Where, you know, that's how their ads get served to you and
28:54
are personalized to you. And you're like, I swear I was
28:57
just talking about this, you know, in, in the neighborhood of
29:01
a, of an echo device yesterday and suddenly I'm getting ads for
29:04
the thing I was talking about. You know, that's how that's
29:07
happening basically. So they very much care about
29:10
identity by the way, but not they don't see it at all in the
29:14
way that we see it. And it's kind of more expansive.
29:18
There's even a standard in the space, kind of a standard in
29:20
industry driven standard called unified ID 2 dot O that I see
29:24
very little talk about in our industry, but it's literally
29:28
based on top of open ID connect. And so in the Venn diagram of
29:34
that world and this world, that's one thing that's like
29:36
right in the center. But like, I don't think
29:38
anybody's really aware, you know, certainly on our side
29:40
about it. So this has tied a lot to like
29:44
e-commerce level CIA. I'm right.
29:47
Who are the stakeholders that we're talking about?
29:49
Who are the the the main participants?
29:54
It's, I would say, you know, you're, it starts at the CMO and
29:58
might be like a chief digital officer or something like that
30:00
as well. So, you know, we have data lakes
30:03
when we think about the security aspects of identity, you know,
30:07
we're interacting more and more with SoC teams like, you know,
30:10
we can talk about identity security and all the new
30:13
acronyms and things like that, where there's some interesting
30:15
tussles between the identity world and the security world and
30:18
where identity even lives in security.
30:20
But when it comes to this Siam world and the fact that
30:24
marketing and customer data management people own the
30:29
proposition and by the way they're making a lot of money
30:32
for that whatever company, that's where we really have to
30:36
care about the stakeholder question because I was looking
30:40
up, you know, so ID Pro has a great vision state on the
30:43
website and it talks about the disciplines of digital identity
30:47
and access management are globally seen as vital and
30:49
vibrant counterparts to privacy and information security.
30:53
That's great stuff. We don't have all the data or
30:57
all the use cases in our purview to be able to really execute to
31:01
that 100%. So that's why I think it's
31:04
important to kind of start to empathize with the whole
31:07
marketing side of the world and the customer data side of the
31:10
world because they absolutely have pains and needs around
31:16
things and identity going well. You know, looking at your
31:19
average description of Siam and all the things that it can do,
31:23
but they just don't know where to go to do better.
31:26
And certainly they don't know where to go to do better at some
31:28
of the privacy aspects. They, they, they interact a lot
31:31
with privacy professionals, with privacy leaders.
31:34
But again, there's, you know, separate goals and sometimes
31:37
competing goals there. Is your research and your work
31:40
focusing on consumers or customers of say a martech or ad
31:46
tech platform? Or is your research more about
31:50
how to run a mar tech grad tech platform from an identity
31:54
perspective? I guess I'd say where I came
31:57
into this picture, it started with the whole EIC 2024 thing
32:01
where I went up there and said consent is dead and started to
32:03
have a bunch of conversations about that.
32:05
And, you know, having been able to lean on a lot of great
32:09
research that's been done, so for example, by Internet Safety
32:14
Labs, of which I'm a board member, I have to say that and
32:17
some other folks like Cracked Labs puts out a huge amount of
32:21
great research. And it's so looking at all that
32:24
stuff, I was sort of like, wow, did you guys know this identity
32:27
resolution thing is scary. It's, you know, heuristically
32:30
figuring out people and it can do it really well.
32:32
And it has nothing to do with somebody logging in and
32:34
confirming that they're them. So it started there and then it
32:39
proceeded to what advice can I give identity practitioners and
32:43
identity leaders about this situation?
32:46
And so in the, in the, the paper called Consent is Dead that I
32:50
ultimately wrote, there's advice about that.
32:53
And then I got the opportunity to go speak to a bunch of
32:55
customer data people and Martech people.
32:58
And that was super interesting. I had to really rethink
33:01
everything and approach things from the perspective of really
33:05
doing the work of empathizing with them.
33:08
And one of the things that I'll share in the EIC talks, so
33:11
people may have seen this already, is there's a, a great
33:15
value framework that's been put together by a kind of marketing
33:18
wizard guy, Kyle Martinovich, the CDP value framework that's
33:23
customer data platform. And that's something that didn't
33:26
exist. CDPS didn't exist, you know,
33:29
back when, you know, we were all coming up with O auth and open
33:32
ID connect, but but it's existed for, you know, last 10 plus
33:35
years. And then everybody has one.
33:37
Any, you know, organization of any size that's consumer facing
33:40
has one. And so here I was talking to
33:41
these folks who care very much about that value framework, but
33:44
wouldn't have known where to slot in the identity value that
33:48
they can get by working with identity people.
33:51
So that's some of what I'll be sharing.
33:53
Yeah, I mean, I'm going to make up a fictitious scenario, but
33:57
let's say I sold training, right and I was able to get data from
34:02
Martech platform on where Eve lives.
34:05
Say you're coming to my website. Now I know where you live, I
34:08
know maybe something about your educational background and I
34:11
know something about your browsing history, So what you've
34:14
been looking at. So now I can build my portal to
34:18
have a specialized set up offerings.
34:22
That seems to me that all those different things lead to kind of
34:27
like a data governance question. Who owns those various pieces of
34:30
data? And then that branches out to,
34:33
well, who are the stakeholders? Who are, you know, making the
34:37
decisions around which of those data elements can be shared,
34:41
which we can use for what, what source of information we use to
34:48
overwrite those. I think you made mention to me
34:50
that you know there's like 2000 attributes that are tracked
34:55
about you that are kind of like these are just known like
34:59
everybody who uses the Internet, these are these are had on you.
35:05
Yes, basically that's true. And, and that stat is just so
35:08
crazy like to us hearing how how identifiable we are, even if we
35:12
didn't, you know, consciously share that information or the
35:15
right to, to have it be known. The average Siam profile, you
35:21
know, the average record might have 20 attributes.
35:25
And the profiles they have on you that you may not be
35:29
participating in are really at that two orders of magnitude
35:32
like 2000. And you can be identified, you
35:35
can be tracked. You know, these are when we
35:37
start talking about surveillance and a whole bunch of unpleasant
35:40
things. But the world is working this
35:42
way now. And it's, by the way, working
35:44
this way in Europe now despite GDPR and all the protections
35:48
that we think that they have kind of, you know, at higher
35:51
levels than maybe some other jurisdictions.
35:54
So what do you do about this because I think it's AI think
35:58
part of this is an awareness issue.
36:00
So I was talking with a friend of mine over the weekend and he
36:03
was blown away when I showed him the ads preferences in Facebook
36:08
and all the things that knew about him.
36:12
And he was not even aware that all this stuff was taking place
36:14
behind the scenes. And I feel like that is pretty
36:16
average. That's pretty common, right?
36:17
Unless you're in this space and you really care about it,
36:21
chances are you're reading the, you know, the ula that flashes
36:24
on the screen. Yep.
36:25
Except I just want to use the thing that I want to use.
36:27
What do we do about this? Because there is so much data
36:30
out there. And what happens if that data
36:32
somehow gets poisoned? If it's incorrect data or wrong
36:35
data, how do you correct it? How does it not impact, you
36:38
know, an algorithm somewhere that either denies you or shows
36:41
you things that you don't want to see or, you know, offensive
36:44
or whatever it may be? Like what can we do about this?
36:46
I mean, GDPR is one of the, you know, pieces of legislation that
36:50
gives people the right to go correct data that's incorrect.
36:53
But it's pretty onerous to do, right?
36:55
And I will say when I was asked that question after I finished
36:59
up talking about consent is dead last year, I was stuck for an
37:03
answer. What do you do?
37:05
What I chose to do for the South by Southwest audience was, you
37:10
know, I I talked a little bit about zero trust and how they
37:12
say assume breach right, which is a good assumption for both
37:15
people and organizations. I suggested as well.
37:20
They need to start assuming tracking.
37:22
So assume breach. Yes, assume tracking absolutely,
37:28
which is, you know, that's not a piece of advice that's sort of
37:32
actionable other than making you think before you share things
37:35
you don't want to get out there. You know, the other joke that
37:38
might be made and especially given where Identiverse is held
37:41
these days, you know, what happens on the Internet stays on
37:44
the Internet. So so like being aware is sort
37:48
of the first thing in terms of doing something about it as an
37:51
individual that can be really tough.
37:55
There are things you can take on board that require some friction
38:00
in your life to do, and that's not something I generally want
38:04
to ask people to do when it comes to identity professionals
38:08
and what we can all do to support the efforts to give
38:13
people more choice, give people more transparency when they are
38:16
consumers of businesses and when you work for those businesses.
38:19
I think we have to, you know, if we take ID Pro's vision
38:22
seriously, we have to try it and do that.
38:24
And that requires understanding the value that is being created
38:28
for the business of each of those pieces of data.
38:30
So when you were talking about data governance, Jim, I totally
38:34
agree. The way that a privacy
38:36
professional would see that is it's kind of a risk assessment
38:39
for each piece of data collected.
38:41
What I think we've been forgetting is the value
38:43
assessment. It's not done on a sort of datum
38:46
by datum basis at all. I think it's possible.
38:50
I know of some technologies that enable that kind of thinking,
38:53
but it surely requires all the different stakeholders to get
38:56
together to agree on what's the model and who's responsible.
38:58
Like if you could actually say we store this piece of
39:01
information, it's worth X to us, but it costs us X plus
39:06
something, Well now you can make an ironclad ROI case for not
39:11
collecting it anymore, putting it on the edge, making it
39:13
decentralized maybe. You know, I wonder if choice is
39:18
the keyword here. You mentioned it earlier.
39:19
I was OK, well, you know, what do we do about this?
39:22
And I don't know if there's actually a good answer for that,
39:25
right? I mean, it's just all this data
39:27
is out there. It's out of your control for the
39:29
most part. Is the future of data management
39:32
when it comes to things like privacy and all these meta
39:35
attributes that people are collecting, is it choice?
39:37
Is it as simple as yes, I will allow you to use my data in
39:41
exchange for this and because the service I find is valuable
39:45
and you know like Google Maps is a great example.
39:47
Nobody. You know, most people I say walk
39:50
around or have in their glove box actual physical maps
39:53
anymore. It is far.
39:55
Rare. Right.
39:56
I mean, I grew up the age of, you know, you had a physical
39:59
map. I lived in Northwest, you know,
40:01
or northeast Illinois in Chicago area.
40:03
So I had one for Wisconsin too, right?
40:05
And so I would have this map collection.
40:07
Now it's Google Maps or Apple Maps, or, you know, whatever
40:11
your mapping solution of choice is.
40:13
But those are free products in quotation marks.
40:16
You're the product at that point, right?
40:18
It's your data that you are trading in exchange for the use
40:22
of their service. So I think the awareness of, you
40:26
know, when, when you kind of say that to somebody who doesn't
40:28
think in these terms is like, oh, it's free.
40:30
No, it's not like you're the product, right?
40:32
Like it's, it's collecting data by you.
40:34
It's it's helping feed the algorithm that says where
40:36
there's a traffic jam on Google Maps by the number of phones,
40:39
right, that are lined up at A, at a, like you're contributing
40:41
to it, but you're also getting a benefit out of it.
40:45
And I think you've got the choice at, at that low.
40:47
You can either choose to use Google Maps or Apple Maps or
40:50
not. But a lot of these choices get
40:53
hidden behind menus and really they're a false choice.
40:57
Are you really going to walk around physical maps?
41:00
Sure. And.
41:02
There and there's some abuse in that, right?
41:04
You know, there's kind of they talk about dark patterns or
41:06
deceptive patterns of like, you know, making it easier to make
41:08
one choice over another. And you can like sort of create
41:11
a straight line to the business model from that.
41:13
And that's something I've advocated for a long time and
41:15
it's starting to be picked up in some places.
41:17
Is the privacy policy really should be an explanation of the
41:21
business model and what out of the three ways that you could
41:25
pay for the service, money, data, attention, eyeballs, are
41:32
they actually leveraging? And you know, you'd think it'd
41:35
be a simple thing of, well, you could do one or the other.
41:37
But then we had this whole sort of pay or OK scandal around,
41:41
well, are we leaving some people out because they can't afford to
41:44
pay to have privacy? So these are, these are
41:48
unresolved questions. I think in the meantime, we can
41:51
get sort of more incremental, incrementally improved systems
41:57
that do respect choice. You know, I do believe privacy
41:59
is context control choice and respect.
42:02
Those are, you know, hard things for a for an organization to
42:05
really sign up to all at once. But I think it's possible if we
42:09
work with the counterparts that are in charge of making money
42:12
off of data, plain and simple. Yeah, I have an example.
42:16
So I was going through some old mail and I get an updated
42:22
privacy policy from my auto lender.
42:26
And it had a like, here's how we use your data.
42:29
And one of the things was we share it with third parties.
42:32
Yes. And then it was whether or not
42:34
you could control it. The answer was yes.
42:37
And I was like, I'm going to save this.
42:38
I'm going to go tell them not to share my data.
42:41
And then I thought, like, am I actually going to spend the time
42:45
to go and do that? It seems like it would be a drop
42:48
in the bucket. Yeah, right.
42:50
And they probably aren't instrumented to do it well.
42:52
And how do you prove that they did it?
42:54
These are some of the questions. So we've been looking at it like
42:58
there's, there's ways to solve some of these, but the first
43:01
thing you got to do is assess the appetite of that
43:03
organization to change if you're working from within it, right?
43:06
You know, if you're working on some identity program within it,
43:09
you can start to ask how open are they to something a little
43:13
bit more innovative and turning away from the direct
43:17
monetization of the personal data.
43:20
And there are cases where that's possible, but there's kind of a
43:23
maturity ladder there. And I think you need to sort of
43:25
be responsive to what's possible there, otherwise you're banging
43:28
your head against a wall. You know, and I feel like, OK,
43:31
your mind goes to, well, we need more regulation.
43:33
But then you get regulations like everybody has like their
43:36
cookie policy now. It's like you can either accept
43:39
it or beat it. And it's like, so you just say
43:42
accept or you try and click close it without answering or
43:46
something like that. So I don't know if more
43:50
regulation is the answer. In fact, I'm pretty sure it's
43:53
not because I think more regulation.
43:55
Led to. Be getting that, yeah.
43:58
I mean, usually anything that that comes out of that is, you
44:02
know, an idea that's not going to work very well And then after
44:05
it's out there like you're, you know, you wind up like doing it
44:09
and it's ineffective. But Jeff, read up a scenario
44:15
earlier, which was, are you getting these spam?
44:18
I'm not even sure if it's on this call.
44:20
We, we talk so much, but it was, you know, I keep getting these
44:24
spam SMS messages that I owe money for toll roads.
44:29
And like, I'm not worried if they're saying, hey, you were in
44:34
San Francisco last week, so you might want to buy, you might
44:37
want to go to Joe's Sourdough House.
44:40
I'm OK with that. That doesn't bother me.
44:43
What bothers me is like the low end spam, like nobody it it the
44:49
scam spam I would call it. Totally.
44:51
And like how? Do you smishing if I could block
44:54
that? Click the link.
44:56
Yeah, I mean, if I could block that, I'm sure everybody's
44:59
sitting there saying something similar, Like if I could block
45:01
that, I'd be I'd be a little bit happier in life.
45:05
The answer is very simple. Just don't use text messaging,
45:10
right? I mean, that's.
45:11
That's the kind of friction fill thing.
45:14
Right. But it's not realistic, right?
45:15
We, we, we've grown to depend on these services.
45:18
I mean, we get MFA through text messaging.
45:21
So, you know, I mean we, we. Shouldn't we?
45:24
Shouldn't. But it's still better than
45:25
nothing, right? I.
45:26
Mean, and this is a case where by the way, you know, when I was
45:29
saying enterprises live in the past.
45:30
So, you know, there are still organizations that are putting
45:33
in place MFA with SMSOTPS right now that haven't even, you know,
45:38
deployed it yet. And yet it's already been
45:40
deprecated in the land of, you know, folks who follow NIST
45:44
800-63. So like, you know, some things
45:47
get get they degrade in quality over time.
45:51
And yet if it takes a while to put in place the program, you
45:55
know, two of my banks have been rolling out voice authentication
46:00
and I want to say defakes. Like they just sort of missed
46:04
the whole moment. We just did an entire AI
46:07
episode, so it's it's gotten crazy.
46:10
Yeah. And actually I heard that from
46:11
some people that we sound better on the AI version, so I'll keep
46:15
that in mind. All right, well, now I know.
46:19
Yeah, exactly. I'll just script every single
46:21
episode from here on out. That is my goal, though.
46:23
Like I have an ulterior goal is at some point I'm going to have,
46:26
you know, AI voices of Jim, you and I, and maybe even a guest if
46:30
I can get them to agree to it. That's going to be virtually
46:33
indistinguishable and the only thing you'll know is that
46:35
there's no Oz. You know those little things,
46:39
you know, you breathing into the mic, you know, like all that
46:42
stuff. But I read a paper today that
46:44
there is actually a new AI model that includes those things in
46:47
it. Oh boy.
46:48
And so of. Course there is.
46:49
At some point, you're not going to know.
46:52
And people will be directing their AI agents to go listen to
46:55
the episodes and then where will we be?
46:58
So, so, E, let's get back on track you.
47:01
One of the things you told me was that you've been encouraging
47:05
your clients to look at identity services as a product.
47:10
So yes, tell me a little bit about what that means.
47:14
So you know, if you have services that are available
47:20
internally for app owners and others marketers, whoever who
47:25
depend on those services, you got to be thinking about all the
47:29
different customers for your product.
47:31
And one of the trends that I've seen over the last few years is
47:34
they're actually product managers in charge of identity
47:38
and what it's delivering to the kind of internal ecosystem
47:41
market. So this is where that four set
47:43
then actually comes in. So for for those who are product
47:47
managers, you'll be aware of the jobs to be done kind of
47:51
methodology where you're really looking kind of under the covers
47:55
of what people say they want out of a product.
47:57
You're looking at what they actually need, kind of the end
48:00
state of what they need. And that's where I sort of came
48:04
up with the four things that I think identity delivers to
48:08
different parties, protection, personalization, payment and
48:15
things people want. So the four PS So I think that
48:19
it's possible to find all the different use cases.
48:22
So security protection, privacy protection, fraud protection,
48:27
all of the kind of cross sell and upsell.
48:29
And you know, this whole CDP value framework that I was
48:31
talking about, all the things that the marketeers want out of
48:35
things that connect with identity.
48:37
You can start to sort out what's important and you can sort out
48:42
who it's important to by looking at those four things and their
48:45
intersections. So being that this is the go to
48:50
podcast for the identity practitioner, I want to ask you
48:54
#1 you know, from a practitioner perspective, what do we need to
48:59
know about this topic? The stakeholder management when
49:02
it comes to CIM and, and you know, specific to thinking about
49:07
this e-commerce situation where we have the martech and the ad
49:11
tech element to it, what do we need to know?
49:15
And then do we own it? Is that IMS to solve or what is
49:20
our role? Sometimes the identity team owns
49:25
some of this and sometimes it clearly doesn't.
49:28
It's interfacing with others who have the primary responsibility.
49:32
And this is where, you know, I'm going to say racy chart because
49:35
it's just sort of the easy, you know, go to framework for this
49:38
one of the. I was fucking a ven chart.
49:40
I mean, there is a been, but like you have to, this is how
49:43
you start sorting out like who kind of really owns what and who
49:46
cares about what and to what level they care about it.
49:49
And I would say you need to start looking at each of the use
49:53
cases. So like I've seen a bunch of
49:55
RFPs where all the use cases are broken down.
49:58
And the interesting thing to me is they don't necessarily break
50:02
down on along product lines or on stakeholder lines.
50:05
Like, you know, the one example I always sort of reach for comes
50:09
more from identity versus security as opposed to this
50:13
marketing conversation. Like, you know, your CIO is
50:16
going to care and their folks are going to care a lot about
50:19
fast, efficient, accurate provisioning.
50:24
It's the people who are risk facing who care about fast,
50:28
accurate deprovisioning. Are you looking at a different
50:33
product? No, so that's kind of the
50:37
challenge. And so like I was, I was just
50:39
talking to some folks, a bunch of seesos who were talking about
50:42
the, you know, is the identity team part of your security team?
50:46
And what they were seeing was about 50% are, and I don't know
50:51
if that tracks with your experience, but it just shows
50:54
the challenge of trying to sort through, well, do you own it?
50:56
Well, up through the chain I do or directly I do.
50:59
Or, you know, how does the SoC team interact with the identity
51:03
team when we've got this whole new identity security landscape?
51:06
Those are some of the questions you can start to sort.
51:09
I think my my experience with those contracts with Jeff was
51:13
saying earlier were like the clients that I've worked with.
51:16
So usually when I get called in to kind of like herd the cats,
51:21
it's because the IM person is the leader.
51:24
The IM person is trying to get all these stakeholders together
51:29
to do some sort of digital transformation or something like
51:32
that. One of the the biggest topics
51:37
that I find that needs to be done is that you have all the
51:40
people who are more than happy to represent their lane.
51:44
Informational security will represent the lane of security
51:47
and and the risk side of the house and IT fast, efficient,
51:52
secure. We're using the right platform,
51:54
we've got the right infrastructure, marketing.
51:56
I just want to sell more stuff and somebody's got to get all
52:02
that to OK, there's only going to be 1 website, not three
52:06
different websites, for example, a website.
52:11
But then also, I think one thing that you've got to do if you're
52:15
like trying to hurt all these people is get them to be
52:17
empathetic to the needs of the other groups because they're,
52:22
it's like everybody's swimming in one pool.
52:24
There's no, you know, you guys stay over here, you guys stay
52:28
over there. It's all just one body of water.
52:32
Yep. And This is why even with all
52:34
the AI tools to help things, you know, it comes down to human
52:38
relationships, even working within an organization.
52:41
And I, I don't see a way to really change that.
52:44
We're going to have to talk to each other and we're going to
52:46
have to figure it out and we're going to have to clarify some
52:49
things that are still kind of squishy.
52:51
Yeah. So, you know, I think a lot of
52:54
what we're talking about, it sounds a lot like identity
52:57
security. And what are your thoughts
53:02
there? I mean, like identity security
53:04
definitely seems to be kind of this new concept, which I think
53:08
we're all trying to wrap our heads around.
53:10
Is it actually indifferent or we just talked about the same stuff
53:14
differently? You know, I'm glad that this is
53:18
the stakeholder conversation is happening more in earnest now.
53:22
It's, you know, couldn't come at a better time because we do need
53:24
to contribute with identity to the security conversation more
53:29
than ever because there's problems more than ever, right?
53:32
And so that's the challenge that identity have has in that it's
53:35
not, you know, if it really is an internal product to a whole
53:38
bunch of stakeholders, it's doing something important and
53:41
it's one of those things that's supposed to be securing things
53:44
better. But what happens when it's a
53:47
source of insecurity? That's like, embarrassing.
53:50
Let's. Just call it a bit.
53:55
So that kind of dual nature of identity has been the challenge.
53:58
And I think what's coming to the fore is we, we do have new
54:01
technologies, we have AI, people are using graph, we're, we're
54:05
getting better visibility across kind of the identity of state.
54:10
And that's enabling us to have better solutions to closing
54:15
gaps, tying up loose ends, doing a good job of whatever it was
54:19
we're doing in the 1st place. So so I kind of like that we've
54:23
got these new augmentations of capabilities that are just just
54:28
giving us better sight over everything the the arguments
54:32
about like what is ITDRA thing like that's all over now.
54:36
We we seem to have some agreement, rough agreement in
54:38
the industry around, you know, what does ITDR mean?
54:40
What does ISPN mean? But I like identity security as
54:44
a bucket, as a kind of a sub bucket.
54:46
Yeah, I like identity security as a bucket because it's pushing
54:49
the identity practitioner to think about more than just
54:53
what's in their lane. But I, where I, I stop is that I
55:00
don't think this puts these things in our lane just because
55:04
we have to be aware of them, just because we have to
55:07
contribute to, to them, say something like logging,
55:10
alerting, or, you know, defending their perimeter.
55:13
All these things because they used an identity element now
55:17
doesn't make them something that the identity practitioner owns.
55:23
Just like, you know, in the olden days when we ran all of
55:26
our stuff on servers, just because we put our identity
55:29
software on a server didn't mean that we own the server, right?
55:32
The infrastructure team owns the server.
55:35
Just because we contribute to policies and standards doesn't
55:39
mean we own, you know, that the the governance processes around,
55:45
you know, turning those into controls and you know, testing
55:49
those controls, that's owned by the audit team.
55:52
We always had to work with other people.
55:54
We need to know how their lanes operated to some extent.
55:58
They need to contribute to some extent, but it doesn't mean we
56:01
own those things. I think identity security almost
56:05
like it's like, put it this way, there's all these companies that
56:09
identity conferences now saying we're, you know, identity
56:14
security. So the people who go to identity
56:16
conferences are mostly identity practitioners, right?
56:20
This was the conversation I was just having is like, well,
56:22
where, where are these tools being used?
56:25
And so far I'm seeing kind of an even split between explicit
56:29
identity teams and like sock teams, right?
56:33
Cause and in a way that's elevating identity to a new
56:37
level of visibility for the CISO.
56:40
And, you know, the, the, the Cheeto conversation seems to
56:43
have subsided a little bit. But, you know, I do see Ciso's
56:46
having a lot more knowledge, direct knowledge about identity
56:50
needs and problems and solutions.
56:53
So I mean, it can't, can't be a bad thing, right?
56:55
We were a small town. We're growing into a bigger
56:57
city. You know, those, those are, I
56:59
think, good things. But we do have to have that
57:01
conversation maybe in each organization about, you know,
57:03
well, what's the, what's the structure of who owns what?
57:06
Let me just talk about it. Well, I wonder if the it's time
57:12
for a macro discussion around the space of identity, because I
57:17
hear identity risk and I hear a qualifier.
57:19
Oh well, we care risk. I hear identity, security,
57:22
another qualifier. I only care about security,
57:25
identity, privacy and consent. More qualifiers.
57:29
Is it just identity? And then I start to think as
57:32
well as a digital identity. No, Digital is another
57:34
qualifier. Right, the website is identity
57:37
right? And, and now we start to get
57:39
into, you know, physical identity, right?
57:41
Or you know, you know, you're you're a human being identity,
57:45
right? Stuff like that.
57:46
And I just every time I hear something identity, it's some
57:50
sort of qualifier identity at the center.
57:52
Guess what? Qualifier.
57:55
You're part of the problem. But honestly, I mean, This is
57:58
why, you know, if you're going to have a shared service and if
58:00
the service is going to be shared widely enough, it's going
58:03
to touch every part of the organization and be subject to
58:07
all of those kind of sharing forces more than anything else.
58:11
And that's something we haven't really looked in the eye as a
58:13
challenge until recently. And I'm, I'm glad of that
58:17
conversation, right? It's like, let's figure out what
58:20
it's valuable for all the things it's valuable for.
58:22
For every company, it's going to be a little different actually,
58:26
And that's OK. But you know, there's value in a
58:30
service that's so widely used to do so many things.
58:36
Just means that the picture looks a little diffuse when you
58:38
when you hand out ownership for any one piece of it.
58:40
Well, maybe it's time to have an identity team, not an Infrasac
58:44
team or an infrastructure team. And that identity team probably
58:47
has a broad set of skill sets that takes it across any number
58:50
of areas. I don't know, right?
58:51
I mean, there's any number of ways that we can slice this one
58:54
out, but I every time I hear something new in identity, it's
58:57
like, OK, it's a new concept, right?
58:59
We one of the episodes we've done in a lot of fast is what's
59:01
the difference between digital identity and identity and access
59:03
management and. I remember that one.
59:05
We had 48 different answers from 48 different people, right?
59:09
Yeah, but mine was right. Oh, well, of course, yes,
59:11
because the context in which you were answering it was right.
59:14
And that was the big thing was like, OK, it depends on who
59:16
you're talking to and blah, blah, blah.
59:18
And so, OK, so now it's identity security.
59:21
I'm going to guess in six months to a year, somebody's going to
59:25
start calling it identity risk or some other juicy acronym that
59:29
we can kind of rally behind. That's great.
59:32
I like to just get to the space of, OK, we're in identity.
59:35
We do identity things. And so that encompasses all of
59:39
this stuff, usability, risk, privacy, consent, governance,
59:44
laws, regulations, right? All that stuff is really under
59:47
the identity umbrella. That's a big umbrella.
59:50
It is. That's what it looks like.
59:52
That Venn diagram looks like an umbrella.
59:54
There you go. See, that's how we tie it all
59:56
together. So so I asked you, we we asked
59:58
you all the hard questions about identity, or maybe they're easy,
1:00:02
depending on how we want to go on this.
1:00:04
We want to end the show on a lighter note.
1:00:06
And the question I've got for you is a would you rather
1:00:10
question? So would you rather have a one
1:00:13
minute conversation with yourself from the past?
1:00:17
Or one minute conversation from yourself in the future.
1:00:21
Every time I look back on my past, I think, gosh, I, I don't
1:00:25
know, 10 years ago, six years ago, 50 years ago, whatever.
1:00:28
I was clueless. I didn't know anything.
1:00:31
Well, at least you're saying that then.
1:00:32
I'm still saying that now. I was like, I don't know what's
1:00:33
going. On I'm still yeah, I mean,
1:00:36
anytime In the past, I was definitely more clueless than I
1:00:38
am now. So my vote is I want to have a
1:00:40
one minute conversation with myself in the future.
1:00:43
And what would you tell yourself would it be?
1:00:45
Here's a stock tip. By Apple.
1:00:49
I was just rereading an old Ray Bradbury short story called
1:00:53
Night Call Collect where it's an old guy, last one guy stuck on
1:00:59
Mars who keeps getting called by his younger self on the phone.
1:01:03
That sounds cool. It is cool and sort of
1:01:06
frightening. It keeps making me think like AI
1:01:08
agents and delegation on behalf of stuff.
1:01:11
You know, these are the things, the questions it's bringing up
1:01:13
in my mind. But like, would I rather have
1:01:15
been the young guy or the old guy?
1:01:17
And I think thinking about the story, so maybe some of the
1:01:21
watchers listeners will know the story.
1:01:24
I mean, I'd rather be the young guy because everything looks
1:01:26
great for the future and all the possibilities are still there.
1:01:29
So I when I'm asking myself a question, am I the young younger
1:01:33
me or the older me asking the question?
1:01:38
She doesn't make me think too hard.
1:01:40
Well, that's why I said maybe it's the harder question out of
1:01:41
all this stuff. Let's go back to the identity
1:01:43
stuff, that stuff we know. Jim, what about you?
1:01:47
Would you talk to yourself from the past or talk to yourself in
1:01:50
the future? And I'm going to exclude talk to
1:01:51
yourself in the current because I know you already do that.
1:01:54
Yeah, I definitely do that. I'm going to go with my future
1:01:58
self because I'd rather get advice.
1:02:01
I mean, sometimes I wish I was younger again.
1:02:05
I could do certain things over again, but I don't know if I
1:02:13
don't, what would I have more money or things like that?
1:02:17
Yeah, I certainly I could have set that up.
1:02:19
But, you know, one minute you could do it.
1:02:21
Exactly what you said. Invest in Apple.
1:02:23
OK, so now you have more money. Is that what would make your
1:02:27
life better? You don't.
1:02:30
Everything that happened between your younger self and now,
1:02:35
you're here now. So you didn't die in a car
1:02:38
accident or something like that. You couldn't avoid that by by
1:02:43
going and visiting your old, your younger self.
1:02:45
Now, if you're sitting there and like something had happened to
1:02:49
you and you're like, OK, I got to say, don't get it on that
1:02:52
plane to, you know, wherever because that would be like
1:02:57
really bad. That's what ruined your life.
1:03:00
I don't have one of those like moments.
1:03:03
I guess you got a series of beds decisions that I've made over.
1:03:06
Time like starting a podcast and trying to do one that episode
1:03:09
every week. I think talking to myself from
1:03:11
the future would yield me like, OK, you know, there's let's say
1:03:17
I talked to 80 year old self and I'm 50 now I've got some advice
1:03:21
for like what should I do for the next 30 years?
1:03:24
Maybe I would fuse yourself and say buy Apple.
1:03:29
I don't know, right? But it might be like, hey,
1:03:33
retire younger or do these things or don't quit working at
1:03:39
at don't retire at 55. I don't know.
1:03:43
But I'd like to have that advice now.
1:03:45
So I. Think this is an interesting
1:03:47
question. I think it's, it's are you, are
1:03:49
you satisfied with your past really kind of determines and
1:03:54
your I guess, and your current state would really determine
1:03:57
whether or not you want to talk to your future self or your past
1:03:59
self. Like do you go back in time
1:04:01
essentially and try to correct a mistake or position yourself
1:04:05
better from wherever you currently are?
1:04:06
Or are you in a good spot right now and you want to make sure
1:04:10
you stay in that good spot or get to a better spot, you know,
1:04:13
in the future? Maybe that's where you talk to
1:04:14
your future self. I just thought of a sci-fi twist
1:04:17
to this. So let's take that same question
1:04:21
and let's say you can choose, right?
1:04:22
You can go as far back or as far forward as you want and
1:04:25
everybody can do it, but you can only go as far forward as you
1:04:30
are alive. And so some people like, oh,
1:04:34
I'll go 30 years in the future and they don't get a phone call
1:04:38
or 10 minutes in the future. They don't get a phone call,
1:04:42
right? That knowledge of something is
1:04:44
going to happen in my future between zero and X number of
1:04:49
days of when I decide I want to receive that phone call.
1:04:53
How does that affect the rest of your life?
1:04:57
There's like the questions we face.
1:04:59
Do we do we do genetic testing to find out?
1:05:02
That's like Twilight Zone stuff right there.
1:05:04
This is like an episode. Of White Mirror, Black Mirror.
1:05:06
Yeah, I still haven't watched a new season yet, so I'm, I'm, I'm
1:05:09
behind on that one. But yeah, for, for those Black
1:05:12
Mirror fans, this this is turning into a Black Mirror
1:05:14
episode or a Twilight Zone. Oh dear.
1:05:17
OK, I, I feel like I absorbed some of Jim in that one because
1:05:21
I, I took it maybe down a little bit downer from it so.
1:05:25
Yeah, dark man. I've got just the upper you
1:05:28
need. Do you want to meet the real
1:05:29
star of impactors? Let's get.
1:05:31
Sabrina on here while you're going to get we we, she was very
1:05:34
disappointed about a lot of the privacy and consent talk that we
1:05:36
were talking through. And you could tell that she
1:05:38
really wanted to join the conversation as you were kind of
1:05:40
getting there. But oh, there she is, Sabrina.
1:05:44
Your fans await. Starofgunfactory.com, star of
1:05:48
now of the Identity Center YouTube channel.
1:05:51
Is she a Chihuahua 6? And 1/2. 6 1/2 and what kind of.
1:05:57
Doug Pomeranian, Chihuahua miniature poodle.
1:06:00
She's a Pomchi poo. And she's a sweet girl.
1:06:03
She looks a lot like one of my my puppies.
1:06:05
It was an Australia dog and or Carolina dog, I should say,
1:06:09
looks like an Australian shepherd, Shibu, sort of like
1:06:11
that. And it has the same kind of
1:06:12
colorings and stuff like that. So I, when I was researching,
1:06:16
you know, for this episode and I went to your website, I saw that
1:06:19
video. I called my wife downstairs.
1:06:20
I was like, look, this is the best part of this website,
1:06:21
right? Here I had to do it with her
1:06:23
because otherwise she was like interfering with the shots.
1:06:25
So you know, that way she helped me.
1:06:28
Well, dogs are always welcome on this show, right?
1:06:30
Awesome. You're always think of when I
1:06:33
see a Chihuahua Sierra Taco Bell.
1:06:39
OK, I don't know how we can top that.
1:06:41
So let's end with Sabrina and Eve.
1:06:43
Thank you so much for taking the time with us.
1:06:45
We're going to have a bunch of links in our show notes.
1:06:47
Connect with Eve on LinkedIn, visit her website,
1:06:49
thenfactory.com, Venn, factory.com.
1:06:52
Say hello to Sabrina as you click that video on the front.
1:06:55
And yeah, our discount codes are always on our homepage, IDC,
1:06:58
podcast.com, Like and subscribe, share with friends, share with
1:07:01
enemies, doesn't matter. As long as people are listening,
1:07:03
like and subscribing, don't really care.
1:07:05
And yeah, that's it. We'll go ahead and leave it for
1:07:07
this week. Thank you, Eve.
1:07:09
Thank you, Sabrina. And we'll talk with you all in
1:07:12
the next one. Take care.
1:07:15
You've been listening to Identity at the Center.
1:07:19
We hope you've enjoyed the show. Make sure to like, rate and
1:07:23
review, and we'll be back soon. But in the meantime, hit the
1:07:26
website at identity@thecenter.com.
1:07:30
See you next time on Identity at the Center.