Latest / Identity at the Center / #319 - Identity Security & Cyber Resilience with David Mahdi of Transmit Security

Transcript

#319 - Identity Security & Cyber Resilience with David Mahdi of Transmit Security · Identity at the Center

• 0:00
  With great power comes great responsibility.
• 0:02
  You are in a position of housing all of my, you know, Jim, you
• 0:06
  and our identities, you better protect them.
• 0:09
  Privacy fraud, scams. I want you to take care of it.
• 0:14
  And if you can't, I'm like, what?
• 0:15
  Decentralized identity is not going to solve that.
• 0:17
  That's just kicking the can down the road to someone else.
• 0:20
  If we don't solve the the transition from IM to identity
• 0:24
  security, decentralized identity is not it's not going to help
• 0:27
  anybody because I'm going to be like, well, I got a verifiable
• 0:30
  claim, but can I actually trust it?
• 0:31
  Well, it was digitally signed by somebody.
• 0:33
  I'm like, yeah, well what if someone manipulated that I am
• 0:37
  back end system of that identity provider and generated that that
• 0:41
  verifiable claim? This is Identity at the Center.
• 0:50
  If it has anything to do with IAM, this is the go to podcast.
• 0:56
  Now your hosts, Jim McDonald and Jeff Steadman.
• 1:06
  Welcome to the Identity at the Center podcast.
• 1:09
  I'm Jim McDonald. Today.
• 1:11
  I'm not joined by Jeff Steadman. Unfortunately, he was unable to
• 1:14
  make our recording session today, but fortunately, I am
• 1:18
  joined by our guest, David Mottie.
• 1:20
  He's the CIO over at Transmit Security.
• 1:24
  He's a past Gartner analyst and a current model for Men's Health
• 1:28
  magazine. I made-up that last part.
• 1:30
  Dave, what do you think? I think that's hilarious.
• 1:34
  You're too kind. But Jim, as always, we missed
• 1:38
  Jeff. Jeff, shout out.
• 1:40
  Hope to see you soon, I think at the Gartner Summit.
• 1:42
  But Jim, absolutely a pleasure to be here and thank you so much
• 1:45
  for having me on again. Yeah, we're glad to have you.
• 1:48
  And you know, if you, for folks who are listening, if you
• 1:53
  haven't registered for the Gartner Summit yet, we do have a
• 1:56
  discount code. It helps us if you use it
• 1:59
  because it lets the Gartner people know that you're
• 2:01
  listening to the podcast and you know, this is one of your main
• 2:05
  sources for industry information.
• 2:08
  Anyway, that code is IDAC 375. There's not a better code out
• 2:16
  there. I think you'd save 375 with
• 2:18
  other codes, including Gartner order code, but go ahead and use
• 2:21
  ours anyway. So having said that, we'll also
• 2:25
  have a link to the registration in the in the show notes.
• 2:33
  Wanted to kind of introduce David.
• 2:35
  Normally what we do is say, you know, how did you get into IAM?
• 2:39
  But David's been on the podcast a few times already.
• 2:42
  He covered that aspect in episode 2 O 9, which was last
• 2:47
  April. He also is with us in episode
• 2:51
  239 this past October. And what I thought was cool
• 2:57
  David was I was looking back through the notes and what we
• 2:59
  talked about and in 209 you talked about this fusion that's
• 3:04
  happening within the industry between cybersecurity and
• 3:08
  identity. And it's like man, like major
• 3:12
  trend. All you know that has been I
• 3:16
  think it's like almost dominant in what we're doing today and
• 3:19
  what we're talking about. The second episode you focused
• 3:23
  on non human identities or I think you were calling it the
• 3:26
  rise of the machines, kind of a wink toward the Terminator movie
• 3:30
  series. Also very predicent or what is
• 3:36
  the word for that? But you kind of saw that one
• 3:38
  coming and now it's like it's on the tip of everyone's tongue.
• 3:43
  We're going to talk about a couple of topics today,
• 3:45
  including identity, security and cyber resilience.
• 3:49
  But what I wanted to ask you about is what have you been up
• 3:53
  to for the past year? And you know, I know you've been
• 3:57
  living in a in the tube flying all over the world.
• 4:02
  I guess that's a big part of what you've been doing.
• 4:05
  Yeah, yeah, 100%. No, I mean, hey, Jim, there's a
• 4:07
  lot to unpack there. Definitely no dull moment in our
• 4:12
  in our space for sure. And there's, there's a lot we
• 4:14
  can do. But I think I think, yeah, a
• 4:16
  good point probably to start on is identity security, because
• 4:20
  whether it's a human or a machine, it, it's, it's the
• 4:26
  whole framework that it's not an option.
• 4:30
  Every organization in the world that has any digital footprint
• 4:33
  will need to have the people, process and technology that
• 4:37
  wraps around identity, security and.
• 4:40
  What? What is?
• 4:41
  What is Identity Security? That is a great question, Jim.
• 4:45
  That's exactly what I was going to no.
• 4:47
  So it's, it's look, there's IM and then there's identity
• 4:50
  security. And they're they're related, but
• 4:51
  they're different. And so, you know, it's great
• 4:55
  that we're seeing the term identity security more and more
• 4:57
  and more. But I think it is a badge that
• 5:00
  you need to earn and it's something that is not easy to
• 5:04
  do. That's both for vendors and
• 5:06
  practitioners. Now, just you know, I know I did
• 5:09
  an introduction in previous episodes, but this one is very
• 5:13
  near and dear to my heart. So my own personal evolution as
• 5:18
  as I sit here today, actually in my view, it maps well to the
• 5:22
  evolution of where I see identity security really
• 5:27
  quickly. You know, I got started, you
• 5:30
  know, when I was a kid in this space, I was very fortunate to
• 5:32
  have access to really good computer hardware.
• 5:36
  And you know, I jumped on pretty early and I really just learned
• 5:42
  how to, you know, mess around with like config dot sys and
• 5:45
  auto execute that bad and got to know that stuff because I, you
• 5:48
  know, learned about memory management only because I wanted
• 5:51
  my games to work. You know, I didn't have enough
• 5:53
  extended memory and all this stuff for certain games and I
• 5:55
  went in and played with all that.
• 5:57
  Anyway, Long story short, I ended up doing bad things
• 6:00
  because I wanted to get games and I got got into doing BBS and
• 6:03
  then IRC and, and then I had folks kind of we traded zero to
• 6:08
  three day wares. And then they taught me, you
• 6:10
  know, just different hacking patterns or what you call TTPS,
• 6:14
  you know, tactics, tools and procedures and learned that a
• 6:17
  long time ago and got into some trouble, but you know, it was
• 6:20
  OK. And so that was in like, I'm
• 6:24
  dating myself here, but that was like in the the 90s, like the
• 6:27
  early 90s and mid 90s. And I always knew back then when
• 6:31
  I was fiddling around and breaking things, that identity
• 6:34
  was, we didn't really call back then, but I always knew those
• 6:36
  systems were just like, to be honest, like a joke.
• 6:39
  Like you can kind of get in and just like, you know, get into a
• 6:43
  system or get into the app and then everything would just be
• 6:46
  stored in clear text. And there's all kinds of things
• 6:48
  that you can do and you know, And so that was a long time ago.
• 6:52
  Fast forward to where we are now.
• 6:53
  I entered the the market as a professional and I started off
• 6:59
  in endpoint security. So not even identity at all.
• 7:02
  Looking at malware, looking at all these things, you know, key
• 7:04
  loggers, spyware, all that kind of stuff.
• 7:07
  And, and then I had a stint there.
• 7:10
  It was about, you know, 6-7 years, then flipped over to
• 7:13
  identity. And I've been in identity ever
• 7:14
  since. And so it's been yeah, like 20
• 7:17
  years almost. Anyway, why am I telling you all
• 7:19
  this? Because when I started working
• 7:22
  the identity space, I always thought this is insane that that
• 7:26
  these tools don't really take into account the activity and
• 7:31
  behavior that's going on on the systems, the endpoints and vice
• 7:35
  versa. With this, the antivirus stacks
• 7:38
  or the endpoint security stacks as we would call them, or even
• 7:40
  platforms, they were like completely blind to identity.
• 7:43
  I'm like, why? Why can't you push to ask
• 7:46
  someone to authenticate if something looks weird?
• 7:49
  I don't understand. And why don't the applications
• 7:51
  have identity themselves or AKA machine identity?
• 7:54
  So that kind of all came together when I was at Gartner
• 8:00
  and it was probably around 2016 ish because my role at Gartner,
• 8:05
  yes, I was on the identity team. But you know, they, they put me
• 8:09
  in a position where I was covering data security, some
• 8:11
  cybersecurity stuff and risk and then identity, right?
• 8:14
  And so they purposely put me in that position to be, you know, a
• 8:18
  convergence kind of analyst to look, you know, looking at all
• 8:21
  this stuff. And so anyway, mapping back to
• 8:25
  identity security, I see it as an evolution.
• 8:26
  I see identity and access management.
• 8:28
  This was all these these tools and solutions again, because I
• 8:32
  was a Gartner analyst. And Jim, you know this 'cause
• 8:34
  you roll up your sleeves, deploy this stuff and you know, it's
• 8:38
  all built for productivity, right?
• 8:42
  I'll just state the definition. I'll read out the definition
• 8:45
  that Gartner has for IM, Jim, and I want you to chime in here
• 8:48
  'cause I've been blabbing too much here, but Gartner's
• 8:51
  definition for IM is I am ensures the right people get the
• 8:56
  right access to the right resources at the right times for
• 9:00
  the right reasons, enabling the right business outcome.
• 9:03
  Now they say people, I think they've updated it to say also
• 9:06
  like machines. So like machines can do it too.
• 9:09
  But when you look at that, Jim, that just said that to me, the
• 9:13
  focus, there's joiner mover lever.
• 9:15
  It's all about productivity, right?
• 9:17
  Jim joins Gartner maybe as an analyst and let's give him he
• 9:21
  the joiner, right? And then we want to give him
• 9:24
  access to all the stuff, all the systems and resources that an
• 9:27
  analyst should have access to so he can do his job, so he can be
• 9:29
  productive. If he can't get access to let's
• 9:32
  say the inquiry data so he could track trends, he can't do his
• 9:36
  job properly. No one wants to get in the way
• 9:38
  of that anyways. Go ahead.
• 9:40
  Well, no, I think to kick it over to me, you know, I've long
• 9:47
  been making the case that that definition is dated and that
• 9:52
  definition is going to, it's going to just be obsolete.
• 10:00
  Maybe it already is. I mean, you can tack on the
• 10:03
  right device and the right time and the right applications as
• 10:07
  many of those things. And then it becomes 3 pages
• 10:09
  long, but yeah. Until you get to the point where
• 10:11
  you say, you know, that the right person has the right
• 10:16
  access to whatever data or applications or whatever and
• 10:23
  they're doing the right things with them, right?
• 10:26
  And which implies that you are tracking that you have
• 10:29
  visibility to how those accounts are being used, which there's
• 10:33
  your identity security. And I'm not, you know, picking
• 10:37
  on Gartner by saying that this is just, to me, it's like, you
• 10:41
  know, there's the administration of the accounts, there's even
• 10:46
  setting up the guards for what is required for a strong
• 10:51
  authentication, things like that.
• 10:53
  Maybe it's continuous authentication is the building
• 10:55
  of all those areas. But then this real next frontier
• 10:59
  is the identity security component, which is.
• 11:03
  And now we're looking at how those identities are being used.
• 11:06
  We're spotting patterns. We're using machine learning to
• 11:09
  say this is normal behavior, this is abnormal behavior.
• 11:13
  And a lot of times people say, oh, yeah, that's what we had
• 11:16
  with UEBA. And it's like, OK, yeah, but
• 11:18
  whatever happened to that? Because I remember when that
• 11:21
  space was first identified, it was like, OK, yeah, this is this
• 11:25
  is going to do something. And, you know, it kind of just
• 11:28
  fell off the charts. And then I TSM comes along and
• 11:32
  to me it's like that's the next great hope is that there's
• 11:35
  something you that's, you know, pulling in how these identities
• 11:41
  and access are actually being used.
• 11:43
  Forget what they're supposed to have access to.
• 11:45
  Like if somebody's trying to access resources that they're
• 11:48
  not supposed to be able to, you know, is that even is that
• 11:52
  normal behavior? Have they ever tried to access
• 11:54
  stuff they weren't supposed to another they're scanning the
• 11:57
  network for? What can they do?
• 11:59
  You know, can you now respond to that?
• 12:01
  Can you now take action on it? So to me, that's where the
• 12:05
  identity security pieces and it's fundamental to what
• 12:09
  identity and access management has to become.
• 12:12
  And it's going back to kind of that key topic that you you
• 12:16
  brought on last April. You know, it's the merging of
• 12:22
  security, you know, SIM logging, etcetera and identity.
• 12:28
  But it probably the the area that makes the most exciting is
• 12:31
  layering the machine learning or you know, AI, maybe not
• 12:36
  generative AI, maybe it's just simply machine learning.
• 12:39
  But it's the cognition of, OK, this is normal, this is
• 12:43
  abnormal, and therefore I should take this action.
• 12:47
  Exactly. And and you know, I think, I
• 12:49
  think so I think I think you're spot on, Jim.
• 12:50
  It's the definition. I think Gartner is, you know,
• 12:54
  evolving it, right? And my view is like it needs to
• 12:56
  go from joiner mover lever and adversary just to kind of
• 13:00
  capture that that framework and the attacks happen, right.
• 13:05
  They look at Verizon data breach report, IBM, like pick any
• 13:09
  research report. The number one form of attack is
• 13:12
  still an identity. We know that.
• 13:14
  And I even found some rough notes.
• 13:16
  I had handwritten notes. I was cleaning up my, my, my
• 13:20
  desks. I saved all this stuff.
• 13:21
  My wife always gets mad at me because I, I'm not a hoarder,
• 13:25
  but I probably should throw out more stuff than I have.
• 13:27
  Like I still have lots of badges and stuff from events from like
• 13:30
  years ago. But anyway, I found some
• 13:33
  handwritten notes like because usually I'm brainstorming and I
• 13:36
  I'd be like, all right, I'm going to write a research note
• 13:38
  on something and I'll brainstorm like the key findings.
• 13:40
  Created about pen and paper. I use a remarkable.
• 13:43
  I'm not sponsored by remarkable. I have it in front of me.
• 13:46
  It's AE ink. I like it because it's
• 13:49
  connected. So it backs up, but I can't
• 13:52
  browse the Internet with it. And I kind of like it because it
• 13:53
  allows me to focus and I use it as a way I can sit out in the
• 13:57
  sunshine and it doesn't look weird like my iPad, you know,
• 14:01
  and it, it just allows me to do that.
• 14:02
  There's just something I don't know because I don't know the
• 14:05
  research, but there's, there's definitely something connected
• 14:08
  with like the brain and, and creativity and all that in your,
• 14:11
  in your fingers and your hands, right.
• 14:14
  So, but anyway, I found research note and the first key finding I
• 14:20
  just scribbled down was, and this was 2017, Jim.
• 14:24
  OK, identity attacks for identity and credential based
• 14:29
  attacks remain number one. OK, So and we look at
• 14:34
  ransomware. One of the last research notes I
• 14:36
  wrote at Gardner was ransomware is not a malware problem.
• 14:40
  And I did that, as you know, to get people's attention.
• 14:42
  And I'm like, it's a, it's an identity and data access
• 14:44
  problem, right? So anyway, the, the, the
• 14:48
  narrative, you know, when you asked me about traveling around
• 14:51
  the world, I just came back recently from Singapore and
• 14:55
  before that I was at the Fido authenticate conference.
• 14:58
  And shout out to the Fido team, you guys did an amazing job.
• 15:01
  Same with identity week as well in in Singapore.
• 15:04
  So I did part of the keynote and the topic was identity crisis,
• 15:08
  why our IM systems are failing us and how Gen.
• 15:12
  AI is going to accelerate their obsolescence.
• 15:16
  When we go back to the Gartner definition, right?
• 15:19
  And we look at identity and it's like, look, all of the main I am
• 15:23
  platforms that have been out there and I, I know them well
• 15:25
  because and I know you know them well and your role and we've had
• 15:28
  a lot of history with them. But also as a Gartner analyst, I
• 15:30
  had a very good insight into them because I've talked to the
• 15:35
  customers, I talked to investors and I talked to the vendors
• 15:37
  themselves. And they bring me on site, I'd
• 15:39
  see the road maps, I'd hear how they're thinking and I'd get to
• 15:42
  see how the, as they say, how the sausage is made.
• 15:47
  And you know, it's just, it's like they're all stuck in the
• 15:50
  innovator's dilemma. A lot of them were anyway just
• 15:54
  doing it. Everything that the customers
• 15:55
  are asking, everything Jim, you said with like governance
• 15:58
  accounts, look at like we can't stop doing that.
• 16:00
  We have to continue doing that, right?
• 16:02
  We're not abandoning what we've done with IAM, but there's a
• 16:05
  reason why these breaches keep happening because attackers know
• 16:09
  that if the F1, they can compromise an identity, they can
• 16:11
  use it. Two, if they can also get to the
• 16:13
  IM system, they can manipulate it and change access and they
• 16:17
  pretty much have keys to your Kingdom.
• 16:19
  So I don't know, I just get very frustrated when people say like,
• 16:23
  oh, single sign on, it's security.
• 16:25
  I'm like, no, no, it's not really.
• 16:26
  It's more of a productivity thing.
• 16:28
  MFA is good. We should be doing it as a
• 16:31
  minimum. But like also remember there's
• 16:33
  MFA fatigue and attackers know about that.
• 16:35
  That's why they go after telcos because if they go after telcos,
• 16:39
  they can do a Sims SIM swap and now they can get the code sent
• 16:43
  to you, right? And there's lots of examples
• 16:45
  like an unpack. So honestly, I just again, I'm
• 16:48
  going back to my evolution as a professional and then I map that
• 16:53
  to the evolution of identity. And I'm like, it's the IM
• 16:57
  providers. They are in the driver's seat.
• 16:59
  They have the money, they've got the positions in, in
• 17:02
  organizations like physically to actually add this stuff on.
• 17:07
  And I think it's actually been, you know, sure, the the security
• 17:10
  platforms, but they weren't plugged into these identity
• 17:12
  systems deeply to see that behavior that you were
• 17:14
  mentioning. And so this is what we're seeing
• 17:16
  now is that finally, after I told a lot of these vendors
• 17:21
  years ago, like you need to start thinking about this now.
• 17:25
  They're starting to see it. And again, it's because you have
• 17:28
  The MGM breach, you have Octa that that was breached several
• 17:31
  times, you know, and CSO's now are like, yeah, identity is the,
• 17:35
  you know, it's at the center right, the name of this podcast.
• 17:38
  So I'll stop there. But that's, that's that's
• 17:40
  effectively, Jim, what I've been presenting.
• 17:43
  And I think I'm like, I'm not going to bore you with identity
• 17:46
  attacks and their stats because I could go on and on and on.
• 17:49
  I think we need to stop and say, why is this happening?
• 17:52
  And I think it's, it's not just the technology, but it's the IM
• 17:56
  people practice and technology. And we have to recognize all
• 18:00
  this technology was built for productivity and especially if
• 18:03
  you're thinking about customer facing stuff, this technology
• 18:05
  was built for workforce employees.
• 18:07
  These directory systems are like 30 years old.
• 18:10
  I'm not using a 30 year old mobile device.
• 18:13
  I'm not even using a 30 year old car.
• 18:15
  So, but anyway, I don't know Jim, what, what your thoughts
• 18:18
  are on that, but that's definitely what I've been seeing
• 18:20
  and and the complaints I've been getting from a lot of leaders in
• 18:23
  the industry. I mean, that is the.
• 18:26
  I think that is the beauty of moving to a software as a
• 18:30
  service model is like you should be get on a system that
• 18:35
  continues to make advancements, keep up with the industry.
• 18:39
  If you pick the right vendor, they're going to be heavily
• 18:43
  investing in the product, making it better and you get to take
• 18:48
  advantage of that. It also gets me thinking about
• 18:51
  kind of the big picture of why I think it's so hard to realize
• 18:57
  the transition from ensuring that the right people have the
• 19:01
  right access transitioning to and that they're using it as
• 19:06
  expected. Because that implies that you
• 19:10
  have visibility and logging in the machine intelligence layer,
• 19:14
  which is hard enough to do in kind of a, a cloud provider, but
• 19:20
  it's manageable, right? Because they, they keep a
• 19:24
  central log of everything happening in their environment.
• 19:27
  And that's why you're able to have Kim solutions.
• 19:31
  And I'll argue with you and Henrique and Paul, who've all
• 19:36
  told me it's pronounced Kim, because to me it's Kim.
• 19:40
  I know it's weird. I, I, you know what?
• 19:44
  There's no argument with me. I just, that's just one of them.
• 19:47
  To be honest, Jim, I just didn't.
• 19:49
  I don't even want to get in that.
• 19:50
  I don't even want to get in that argument, whatever you want to
• 19:52
  call it. I I just actually just say CIEM
• 19:55
  and that way there's no like confusion.
• 19:58
  Cloud infrastructures made possible by the fact that your
• 20:03
  cloud provider sets up a whatever they call it, a tenant
• 20:07
  for you and they have an IM system and they log all the all
• 20:15
  the activities centrally and can map.
• 20:19
  The access you have versus the access you're using and
• 20:22
  constantly enable you to cull, you know, entitlements or roles,
• 20:28
  things that you know, access that people have that they don't
• 20:31
  need, which is what creates the, you know, the expanded attack
• 20:38
  surface. To me, that's very hard to do in
• 20:43
  the enterprise and it's why that the Kim functionality is kind of
• 20:48
  limited to just clouds. You can't get Kim for the
• 20:52
  enterprise, can you? No.
• 20:54
  Well, I mean, I think the challenge there, there's a few
• 20:57
  things. Number one, you're only, you're
• 21:01
  only the Kim solution is only able to access push and pull,
• 21:06
  right. So, so pull, meaning it can get
• 21:09
  those logs, get the data, push meaning it can execute commands
• 21:14
  and do things. And they're on the subject of
• 21:16
  whatever the cloud provider allows, right?
• 21:18
  So whatever, whatever, say APIs, they they give you access to,
• 21:24
  you can, you can do those right, programmatically and have
• 21:27
  automation and all this stuff. Or, you know, those cloud
• 21:30
  providers can keep it for themselves and say, no, no, you
• 21:32
  got to use our own, you know, our own mechanisms in order to
• 21:35
  access those. So that's the challenge.
• 21:38
  And then you're right on Prem. It's just a it's a mishmash of
• 21:43
  yeah, maybe SIM and other discovery tools and other things
• 21:47
  like that. I actually had a call recently
• 21:49
  about post quantum cryptography and they were just SAS.
• 21:52
  And I don't want to like conflate everything here and go
• 21:54
  and go off the rails. But like, you know, because I
• 21:57
  also need to cover that. When I was like Gartner and I, I
• 21:59
  had some folks asking me, what do you start with that?
• 22:02
  How do we get ready? Right.
• 22:03
  And it's like discovery tools and all this.
• 22:05
  Oh, and keep in mind how you do discovery and management with
• 22:09
  these cloud environments, Jim, going back to Kim or C i.e.
• 22:13
  M is going to come back to that. But I mean, I think the, the
• 22:17
  biggest thing in our industry right now in my view, but I
• 22:22
  don't really care because I'm it's anchored in facts, is a lot
• 22:25
  of these breaches, which are obviously pretty important,
• 22:30
  they're tied to identity. And I go, OK, who are the
• 22:35
  leaders of the industry? We know who the leaders are.
• 22:37
  Solve that problem, please. And if you're not solving it, I
• 22:41
  mean, that's why we see, it's great.
• 22:42
  We see a rich landscape of ITR vendors and all this stuff
• 22:46
  popping up. And I think we're still going to
• 22:48
  continue to see that. But it's not just, and I don't
• 22:50
  want to make this purely about the technology, it's also the
• 22:53
  organization's themselves. If your identity team is
• 22:56
  different than your, you know, your information and your
• 22:59
  cybersecurity teams that you got a problem there, you need to
• 23:01
  start bringing them together. You need to start thinking about
• 23:04
  red teaming and doing tabletop exercises for your identity
• 23:08
  team. Even though they might be only
• 23:09
  focused on productivity, they need to be aware of these
• 23:14
  different types of attacks that all focus on identity.
• 23:17
  And don't even get me started with deepfakes because that just
• 23:20
  changes everything, right? So I think all of these, the
• 23:24
  reliance on the productivity centric based stuff has caused a
• 23:28
  lot of issues. And then there's another point
• 23:30
  to all this, Jim, which I, you know, when we unpack identity
• 23:33
  security, it means all of the things we did with IM but an IM
• 23:39
  system and the teams that are threat aware, fraud aware, and
• 23:44
  they're able to actually say like, oh, wait, this isn't Jim
• 23:47
  his behavior. That's not him, right?
• 23:49
  Like, maybe we should stop it. And then, oh, Jim was travelling
• 23:52
  and, you know, Jamaica this week and OK, it looked weird, but you
• 23:57
  know, it's him. Maybe we'll give him disabled
• 23:59
  access because he's, he's not in a place we, you know, would
• 24:03
  prefer to whatever, whatever reason, but we'll give them
• 24:06
  access, right. So the, so it's answering the
• 24:09
  question like, who is the user? Who is this thing?
• 24:12
  Is it the right thing? Is it the wrong thing and all
• 24:14
  that stuff. And I think that identity is the
• 24:15
  place where you start, but the threat awareness the the
• 24:20
  security side has to be. I think some of these tools have
• 24:23
  to have to, just on the Jamaica thing, they have to run in
• 24:26
  learning mode for some period of time before you start taking
• 24:30
  kind of archaic action. You know, I was kind of thinking
• 24:35
  about the point that you made a little bit earlier, which was
• 24:37
  around, OK, these leading security vendors like fix the
• 24:42
  problem. Is it is that their problem to
• 24:45
  fix or is it the CIS OS problem to fix?
• 24:51
  In other words, piece together the solutions that you need to
• 24:54
  secure your enterprise. Because you can say, all right,
• 24:57
  my access management vendor protects me up to the point of
• 25:01
  coming in the door. But then, you know, you might do
• 25:05
  a great job at that, but maybe somebody's already been through
• 25:09
  the door or, you know, one in a million gets through and then
• 25:14
  they get into your system and live off the land for what's the
• 25:17
  average if somebody gets in until it's detected?
• 25:20
  Three, Yeah. So actually that's a great
• 25:22
  question. So IBM and their recent data
• 25:24
  breach report, it was like the average time to detection of an
• 25:30
  identity related breach is like 300 days or like close to 300
• 25:33
  days on our, let's just say it's 300, right?
• 25:36
  How much damage, Jim, do you think you can do in 300 days if
• 25:39
  you had an employee's account or a a customer account, right?
• 25:44
  You only have to do. You only have to do the ultimate
• 25:46
  damage. It's like you could have army
• 25:49
  spread out all over the the world.
• 25:52
  Yeah, all you need to do is detonate 1 nuclear weapon.
• 25:55
  Exactly. And, and let's be honest.
• 25:57
  Oh no, go ahead. Sorry.
• 25:58
  Keep going. That's that's your, that's your
• 26:00
  like super domain admin of your Active Directory for many
• 26:04
  organizations, like if you're somehow able to get your hands
• 26:07
  on that account, living off the land, trying to get access to
• 26:12
  non human identities, which by the way, in 99% of
• 26:18
  organizations, 90%, nine percent of use cases are not using MFA.
• 26:23
  No. A lot of times the most powerful
• 26:26
  accounts, the organization doesn't even know all that they
• 26:29
  do. They're afraid to shut it off or
• 26:31
  afraid to take away that super admin capability.
• 26:35
  Or maybe you're running some kind of, you know, third party
• 26:39
  software and it requires access to your network and you're
• 26:42
  looking at the next solar solar winds kind of scenario.
• 26:45
  Yeah, I mean, it's those are the nightmares, right?
• 26:48
  You said there's a lot of very important things that you just
• 26:51
  said in like the last 20 seconds, honestly.
• 26:54
  I mean, I do I, I throw 20 ideas into one statement and I say,
• 26:59
  you know, you ever see the, the SNL skit, the old one, give me
• 27:03
  more cowbell and I want you to explore the spaceman.
• 27:07
  So I threw a bunch of ideas out there.
• 27:09
  Take it, David, run with it. Explore the space.
• 27:11
  All right, all right, I'm going to use it, but I.
• 27:13
  Gotta have more cowbell baby. I'm using my remarkable to, you
• 27:17
  know, just track some of these things.
• 27:18
  But OK. So number one, let me first just
• 27:22
  go to the first, the first point you, you pose and you're like,
• 27:26
  well, who, who is responsible for all this stuff, right?
• 27:28
  It's like, OK, let's set that aside for a second and just talk
• 27:31
  about outcomes, OK? If you and I, Jim, we were like,
• 27:37
  you know you're ahead of risk and I'm the CSO for a very large
• 27:40
  bank, OK. And we just keep getting these
• 27:44
  identity breaches and let's just say, you know, we know that
• 27:46
  we're using a market leader for IM and for a customer facing
• 27:51
  environment and maybe we're using the same platform because
• 27:53
  we thought that might make sense from a financial perspective.
• 27:56
  Our CFO liked it and you know, then we've got you know, we know
• 28:02
  we have all these like best of breed cybersecurity tools and
• 28:06
  platforms and cloud security and this that and the other right.
• 28:08
  We were like, OK, well, hold on, why did we just have this
• 28:11
  identity breach and whose fault is it right?
• 28:16
  Well, look, number one, you mentioned productivity, right At
• 28:18
  the end of the day, you said scared, scared to turn it on
• 28:21
  that remember, like the definition of I am is right.
• 28:25
  People write access right resources, but the reason why so
• 28:29
  many accounts have so much access to stuff they shouldn't
• 28:32
  have is because no one wanted to get in the way and frankly
• 28:35
  people downplayed all the the attacks.
• 28:37
  I I know because when I was a lot younger than I am now and my
• 28:41
  first security job there was a ACIO that will go unnamed and
• 28:47
  maybe if they're still around I don't know.
• 28:48
  This was a long time ago, but they were like just about to
• 28:51
  retire. And I remember showing them all
• 28:52
  these vulnerabilities and you know, I can, I can easily do
• 28:55
  this. I could easily like get access
• 28:56
  to this. And then he said to me, this was
• 28:58
  like 20 years ago, Jim son, no one would ever do that.
• 29:03
  Why would someone come into our environment and take our data?
• 29:06
  It just doesn't make any sense. OK, And this this was AI can't
• 29:12
  say who it is, but in the, in the, the sector and it was kind
• 29:14
  of like finance a little bit good size organization too.
• 29:19
  And I was, I still kept that to this day, I still, that's still
• 29:22
  in the back of my mind. But I don't think any CSO, if I
• 29:25
  go back to you and me being the CRO and the, and the CSO, we
• 29:28
  wouldn't say that we'd be like, well, we have no idea if people
• 29:30
  are already in our network. We just have to always assume
• 29:32
  breach and always look at, you know, what people are doing.
• 29:36
  But whose fault is it? What do, what do we do?
• 29:38
  Well, look, we know we have this IM system, but we know now that
• 29:43
  it should like we're hearing from Gartner about ITDR.
• 29:46
  We're hearing from others about, you know, identity breaches
• 29:49
  takes 300 days, like that's pretty scary.
• 29:51
  So our job is to mitigate the risk.
• 29:54
  And if we look at some of these platforms, we're not necessarily
• 29:56
  going to like RIP them out because they're very sticky and
• 29:59
  they're managing all of our identities.
• 30:01
  But they are in the position, right of, of, of building out a
• 30:08
  more threat aware features and functions because they are the
• 30:13
  ones that create and manage the identities.
• 30:15
  If you're managing the identity, shouldn't you also manage the
• 30:17
  security? But they're not.
• 30:20
  And look, it's hard. It's hard for them to do that
• 30:24
  because security is not something you can slap on with a
• 30:27
  Band-Aid after. It has to be foundational.
• 30:29
  And I think you and I can both agree just with the name of the
• 30:32
  podcast, right? Identity at the center.
• 30:34
  If identity is like part of the steel and concrete foundation of
• 30:38
  your digital business is a house, right?
• 30:41
  You can't take security and put it on top of the steel.
• 30:44
  Like it's just like it has to be that steel within the concrete.
• 30:48
  So if I were to use that analogy, the identity and access
• 30:51
  management system would be like the concrete, but it's weak
• 30:54
  without steel security, you know, crypto, agile
• 30:59
  cryptography, which would be your authentication of using
• 31:02
  Fido based methods. You know the threat aware all
• 31:06
  the fraud stuff, all of that is the steel that's in that
• 31:10
  concrete layer. What I see today and the reason
• 31:14
  why we have a lot of these breaches is because attackers
• 31:18
  fully well know that the IM systems are missing that steel.
• 31:23
  They're getting better, but because it hasn't been put into
• 31:26
  the foundation itself, we are going to continue to have
• 31:29
  problems. So it's it's maybe going to be
• 31:32
  the fault of the vendors. But if you and I are charged
• 31:35
  with mitigating risk for the organization and we see like the
• 31:39
  platforms, we're either going to put in compensating controls and
• 31:42
  that's what companies are doing now.
• 31:44
  And at some point, I think in the very near future, you're
• 31:46
  just going to say, well, why don't we just start to like
• 31:50
  introduce an actual identity security platform that's built
• 31:55
  with that steel and concrete foundation already versus
• 31:58
  slapping it on because we can't slap it on anymore.
• 32:00
  And like I said, a lot of those platforms, like honestly, they
• 32:02
  were amazing. They helped create the market.
• 32:05
  And you know, but with all that good stuff comes a lot of bad
• 32:09
  stuff. And I'm going to use the last
• 32:10
  thing I'll say, Jim here on this point is Spider Man, right?
• 32:13
  With great power comes great responsibility.
• 32:16
  You are in a position of housing all of my, you know, Jim, you
• 32:20
  and our identities, you better protect them.
• 32:23
  Privacy fraud scams. I want you to take care of it.
• 32:28
  And if you can't, I'm like, what?
• 32:29
  Decentralized identity is not going to solve that.
• 32:31
  That's just kicking the can down the road to someone else.
• 32:34
  If we don't solve the the transition from IM to identity
• 32:38
  security, decentralized identity is not it's not going to help
• 32:41
  anybody because I'm going to be like, well, I got a verifiable
• 32:44
  claim, but can I actually trust it?
• 32:45
  Well, it was digitally signed by somebody.
• 32:47
  I'm like, yeah, well, what if someone manipulated that?
• 32:50
  I am back end system of that identity provider and generated
• 32:54
  that that verifiable claim not going to happen right Anyway
• 32:58
  I'll stop there. I clearly I'm I'm getting very
• 33:00
  passionate about what I'm. Doing here, yeah.
• 33:02
  And I'd like to shift the conversation a little bit to the
• 33:06
  non human identity side because we've talked about this Gartner
• 33:11
  definition and it's you know, and ensuring the right people
• 33:15
  have the right access etcetera, etcetera.
• 33:18
  And then you even made the statement.
• 33:20
  Well, maybe it's they've amended it to be the right people and
• 33:24
  the right whatever things or something like that.
• 33:27
  And I've always said, well, I don't think a thing is an
• 33:30
  identity, but put that aside. I'm not going to argue that
• 33:32
  point today. The point I'm going to argue is
• 33:36
  that I think these machines are non humans.
• 33:42
  They're they've been ignored. And that's why it's like such a
• 33:47
  bingo moment. It's like, oh hey, let's talk
• 33:49
  about non human identities, folks.
• 33:52
  I was talking about non human identities.
• 33:54
  I didn't have a catchy term for it, but I was talking about it
• 33:58
  when I was a Windows System Administrator in the 90s.
• 34:02
  You know, service accounts were the bane of my existence.
• 34:06
  But then I started learning about identity management
• 34:08
  systems and it was identity management.
• 34:10
  But today we call it identity administration and governance
• 34:14
  and what is really good, and I'm talking about workforce at the
• 34:17
  moment, right? And this workforce identity.
• 34:20
  And I'm thinking, OK, well, here's how it works.
• 34:23
  There's really just black and white one right way to do it,
• 34:27
  which is that you have authoritative sources, systems
• 34:30
  of record for all the identities for all the people who work here
• 34:35
  are the, you know, so it's like the HR system for the people
• 34:38
  might be some kind of contractor system for the contractors.
• 34:44
  So, but everybody has to be covered and maybe even do it
• 34:47
  with your IGS, maybe even there's like some kind of
• 34:50
  workflow that you enable, but there's some way that those are
• 34:54
  covered. Non human identities.
• 34:56
  Not the case there. I haven't met an organization.
• 35:00
  It's like, well, show me the system of record for, you know,
• 35:03
  maybe they use ITSM tickets or maybe they use IGA for some of
• 35:08
  it. Maybe they use Pam for some of
• 35:11
  it. I don't think those are there's
• 35:15
  a sufficient solution out there that says, you know what folks?
• 35:19
  You know what digital identity industry, you've been handling
• 35:22
  non human identities wrong. There needs to be a system of
• 35:25
  record. Yeah.
• 35:25
  Do you agree there should be a system of record?
• 35:28
  I mean, there should be a system of record, but remember, I think
• 35:30
  there's a lot of parallels that we can draw to the evolution of
• 35:33
  just I am and generally right, but we know about identity
• 35:36
  security. So we should, you know, as we go
• 35:39
  on the path of, you know, non human and machine identity,
• 35:43
  that's a whole other topic on its own.
• 35:45
  But you know, I know gardeners because I, you know, myself and
• 35:50
  Eric Walsh from define machine identity And we, there's a lot
• 35:52
  of data and customer interviews and all that where we, we came
• 35:56
  up with that term. And I'm like, we don't call it,
• 35:59
  you know, with machine learning, we call it machine learning.
• 36:01
  And we know what machine learning is, or at least
• 36:03
  hopefully, hopefully you know what it is by this point.
• 36:05
  You should we don't call it non human learning that doesn't make
• 36:10
  any sense and we don't define things based on what they not
• 36:12
  are I'm like look I've got 2 water bottles here they're both
• 36:16
  non human. My sweater is non human.
• 36:18
  At least I hope it's non human. You know what I mean like it's
• 36:21
  just it's like tell like, you know science became what it is
• 36:26
  because we had proper definite. We had the scientific process,
• 36:29
  right, but we also had definitions.
• 36:31
  So we can say, yes, there's, you know, dolphins, but there's
• 36:36
  different kinds of dolphins, right?
• 36:38
  There's dogs, there's different kinds of breeds of dogs.
• 36:41
  They're also all non human, right?
• 36:43
  So anyway, I don't want to get on that train, but we can.
• 36:46
  Certainly, but that's a good point because I, I think it's
• 36:50
  like, OK, you have human identities now you have non
• 36:52
  human identities. What are the different types of
• 36:55
  non human identities? And should they be treated
• 36:58
  differently? Because if we're going to say
• 37:00
  they're one group, I mean, that's just where we're at in
• 37:03
  the evolution. But I think it's like, remember
• 37:07
  the the 20 questions again, is animal, vegetable or mineral,
• 37:11
  right? And I think there's like five
• 37:14
  types of things, you know, there's like a gas or whatever.
• 37:18
  And but it's, there's different types.
• 37:22
  So there's just like there's account application accounts and
• 37:27
  service accounts. They're different.
• 37:29
  They're different. There's ephemeral accounts I
• 37:33
  there's OT account. Is OTA part of this?
• 37:36
  And so the, the, yeah, there's accounts and then there's also
• 37:40
  like machine process, so containers.
• 37:43
  And I'm going to actually write up a, a little summary, or at
• 37:46
  least my take on it. But Satya Nadella's presentation
• 37:49
  from Ignite, right? It was pretty crazy because he's
• 37:53
  talking now about Copilot and then but copilot having like the
• 37:57
  ability to create all these agents and you know, and
• 38:04
  basically you're just saying like you're going to have an
• 38:06
  agent that's going to going to work with you, work for you.
• 38:08
  So for example, anthropic, right, who's another kind of
• 38:11
  open AI like company. They've made this product called
• 38:16
  Claude AI and Claude AI can Jim. It's almost like it's scripting,
• 38:20
  but just insane. It can take over your PC and do
• 38:24
  certain things and you can tell it to do that.
• 38:26
  And so look, we all see where the trend line is going and the
• 38:29
  trend line is going to have like these bots and all these things
• 38:33
  take over for us. But that is another, to your
• 38:35
  point, another flavour of machine.
• 38:37
  Here's the thing, and this is the parallel I was trying to
• 38:39
  draw. If we go back to the beginnings
• 38:43
  of IM as organizations were starting to, you know, network
• 38:48
  computers and start to leverage, you know, applications and all
• 38:51
  these types of things, right? Every application had its own
• 38:54
  identity store, right? See, so this is what I was kind
• 38:57
  of referring to before. Like if I knew there was a
• 38:59
  critical application in an organization, I could like go
• 39:01
  and look and like, like just RIP it apart because I learned how
• 39:05
  to read hexadecimal at a very early age, again, to mess around
• 39:09
  with my games, You know, give yourself more health, more
• 39:13
  money, whatever within games. But you can do the same thing
• 39:16
  with some of these systems. And every system had its own
• 39:19
  identity store in embedded in it.
• 39:22
  And the problem with that was like, OK, join him a reliever.
• 39:24
  Jim joins the organization. Now we have to go to every app
• 39:27
  that he might use and create an identity for each one.
• 39:30
  That was obviously a problem. So then they say, let's make
• 39:32
  what a single source. And that's where HR gets
• 39:35
  involved. And it's not just like IT, it
• 39:37
  was a bunch of lines of business that would get involved to to
• 39:41
  have that identity system manage that identity system.
• 39:43
  So Jim joins, we go to that one source, put him in an
• 39:47
  organizational unit, blah, blah, blah, blah, and then he gets
• 39:49
  access to all that. We don't have that for machines
• 39:52
  today. So machine, machine identities
• 39:54
  today, all those flavors that you mentioned, Jim, they're all
• 39:59
  like what we saw a long time ago at the beginning of I am.
• 40:04
  Each, let's call it application, right, has its own ability to
• 40:09
  create, you know, service accounts or containers or apps
• 40:13
  or any kind of entity that would be a type of machine.
• 40:17
  And those can mint those, those those ephemeral identities or
• 40:21
  all those things. So we need a way at least today
• 40:24
  to get plugs into those so we can push pull into those
• 40:29
  different types of sources. So you can number one, you can't
• 40:32
  measure what you're not managing.
• 40:33
  So we got to get, we got to get a hold of those.
• 40:35
  So right now what I see a lot of us, you know, the, the NHI
• 40:38
  vendors, you know, they've got a lot of discovery capabilities,
• 40:44
  but less so in my analysis of it.
• 40:48
  And when I talked to some analysts as well, you know,
• 40:51
  they're lacking, I think in some of the governance areas, right?
• 40:53
  So I think they're getting to that.
• 40:55
  I think that's a part of the road map.
• 40:56
  But I. Mean that's a good point,
• 40:58
  though. The other thing I want to cut in
• 41:00
  on is, you know, kind of know your role.
• 41:03
  Like what is your role? Is it to centrally manage all
• 41:08
  non human accounts for the entire organization?
• 41:11
  What if you're in a global organization?
• 41:14
  You could be talking millions of accounts that you don't have a
• 41:17
  central system of record. You can't manage those.
• 41:20
  Is it to govern them? Is it to monitor their usage?
• 41:26
  I find that if you're, if you're a practitioner and you just sign
• 41:30
  up for something and you don't define what that is, you're
• 41:34
  setting yourself up for potential failure because one of
• 41:37
  those accounts could be used in the preach that takes down a
• 41:40
  major part of the operations of the organization.
• 41:44
  Yeah, yeah. No, that, that's an excellent
• 41:46
  point. So let me go back to you and I
• 41:48
  being those other personas, you know, be the CSO, you're the
• 41:50
  risk officer. We can sit here and ignore them.
• 41:55
  And a lot of organizations are doing that.
• 41:56
  And why are they doing that? It's not because they're
• 41:57
  ignoring them because they're malicious.
• 41:59
  They're just ignoring them because they haven't been a
• 42:02
  problem. They haven't been a problem both
• 42:04
  in like they haven't maybe identified them necessarily as
• 42:07
  a, you know, a breach source. And auditors aren't really
• 42:12
  looking for this, at least yet, right?
• 42:15
  That's what honestly like that's what transformed privileged
• 42:18
  access management, that whole space.
• 42:19
  I mean, Edward Snowden happened and auditors are looking at like
• 42:23
  all these accounts from a privileged perspective.
• 42:25
  And that's what gave birth to the Pam market machines.
• 42:28
  I think, you know, we'll start to see that because there's
• 42:33
  definitely areas where attackers are going to use and have used
• 42:38
  these things. But I think the issue, Jim, to,
• 42:40
  to what you illustrate is like, look, if if the board came to us
• 42:46
  and said, look, we have intelligence about potentially
• 42:50
  some state actors, you know, going after our competitors
• 42:56
  because potentially a state actor has access to a quantum
• 43:00
  computer that can break, you know, some of the, you know,
• 43:04
  some common cryptography. OK, what do we do with that?
• 43:07
  It's our job. They're going to look at us and
• 43:08
  they're going to say, Jim, David, what's our risk here?
• 43:13
  We throw our hands up in the air and be like, well, we have no
• 43:17
  idea what systems are using, you know, what systems are
• 43:19
  vulnerable to that, to those types of attacks, right?
• 43:24
  And so our job then is to 1st go out and discover all of the, all
• 43:29
  of the systems that use cryptography and or create
• 43:32
  machine identities or non human identities based off of that.
• 43:35
  And then we can start to say, well, what's the risk?
• 43:37
  Oh, you know what, most of the systems that would be at risk,
• 43:41
  there are all these legacy ones and they're behind all of this
• 43:44
  other stuff. But we need to do, we need to
• 43:46
  tackle it, right? But we could prioritize or we
• 43:49
  could say, oh man, our entire, our entire customer facing
• 43:53
  business where we're generating millions and millions of
• 43:57
  whatever currency an hour we'd have to take down our website,
• 44:01
  we have to rotate the certificates.
• 44:02
  We'd have to, you know, so that's what it kind of comes to
• 44:05
  with humans. I think, you know, we can say
• 44:08
  like, OK, we know we have X number of employees or X number
• 44:11
  of customers that come in and out to our environment and
• 44:15
  there's a little more, it's a little easier for us to wrap our
• 44:17
  heads around. I think the issue with machines
• 44:19
  and just their flavors, their types and the amount of them,
• 44:22
  that's confusing. And what I was trying to say
• 44:25
  before with Copilot is expect the next wave of machines to
• 44:29
  come in even more so. And This is why it's critical.
• 44:33
  We have to, number one, get this definition right and get behind
• 44:35
  it. OK.
• 44:35
  And so to me, I'm like the definition of machines, it's
• 44:38
  already done. I don't know why we're wasting
• 44:39
  time confusing people, frankly, about NHI because like I now
• 44:44
  have to define that when people, when I talk to people and it's
• 44:47
  just a waste of time when we should be focused on like moving
• 44:50
  this thing forward versus arguing over definitions.
• 44:53
  That's just it's a waste. Sorry, it's.
• 44:56
  True, it's. True.
• 44:57
  You know, we need to move on and it's like we're not going to
• 44:59
  change. We're not going to call it non
• 45:01
  human learning. It's machine learning.
• 45:04
  So get behind the program. It's already there.
• 45:07
  Machine ID do your do your job and defining what they are and
• 45:10
  you'll help people versus wasting time on definitions
• 45:13
  anyway. But I think if we go back to all
• 45:15
  of it, it is not an easy job to be a risk officer or AC.
• 45:21
  So now, especially now that you have to really start to think
• 45:23
  about identity. And that's where, you know, I
• 45:26
  think these the, the practice needs to move to identity
• 45:29
  security and it needs to be inclusive of machines that needs
• 45:31
  to be a part of the program. Because again, you, you know, if
• 45:36
  you're going to ask you and me, you know, Jim, David, what's
• 45:39
  our, what's our risk here to our organization?
• 45:42
  You know, we can at least come back and say, here's here's our
• 45:45
  risk quantification machine identities.
• 45:47
  You know, we have to start leveraging tools, processing
• 45:50
  people, human identities. We're using kind of a
• 45:53
  productivity centric system. You know, it's good, it's
• 45:57
  worked. But at the same time, if someone
• 46:00
  got into our environment, they could do IM manipulation and
• 46:05
  they could get access to a lot of different things.
• 46:07
  So, you know, we have to pick and choose our battles.
• 46:10
  But I, but in my view, if we can start to embody identity
• 46:14
  security with our humans, we can use that maybe simultaneously if
• 46:19
  you can, but use that as the, as the, as the example to say like,
• 46:26
  hey, we showed you how we've had to evolve this to identity
• 46:30
  security for our humans, our partners, our customers and our
• 46:34
  our employees. We got to do the same for
• 46:36
  machines, right? So it's a big and bold kind of
• 46:39
  proposition, but I would start with the humans obviously, and
• 46:45
  start to kind of weave that in. The other point too, I'm just
• 46:47
  going to say here, both for humans and machines in my
• 46:52
  travels and a lot of my discussions I've had with
• 46:54
  hundreds of Seesos over the last few months, cyber resilience,
• 47:00
  cyber resilience. So Jim, I don't know, I want to
• 47:02
  hear your take on it too, because I know you have tons of
• 47:04
  conversations. I want to hear your view on it.
• 47:05
  But I'll just say really, really quick, especially when I, when I
• 47:07
  came back from Singapore from Identity Week, that was a big
• 47:10
  topic. There's been some major outages.
• 47:12
  So, so here's the thing. Think about a bank again.
• 47:15
  And banks, big banks, they're like, well, hey, we've got
• 47:20
  amazing digital services now, right?
• 47:21
  We've got mobile apps, we've got web apps.
• 47:23
  People can like do banking on your phone.
• 47:25
  Yeah, I can. I can transfer money and send
• 47:27
  money to you. Well, what happens if there's an
• 47:31
  outage? Because, you know, that never
• 47:33
  happens and they have an authentication outage or their
• 47:36
  IM system becomes unusable, or the cloud system they're using
• 47:39
  just has a major outage. Someone cuts a fiber optic line
• 47:42
  in the middle of the ocean. That's never happened before and
• 47:46
  that won't happen in the future. Come on.
• 47:49
  Business continuity disaster recovery.
• 47:52
  The problem here is that, and I know because I've heard from the
• 47:56
  CSA recently in a major financial institution, they,
• 47:58
  they were just like, yeah, no, our bank is, is on a tear
• 48:01
  getting rid of branches. So if we go down, if our digital
• 48:04
  systems go down, let's just say their authentication system goes
• 48:08
  down. You got to go into a branch.
• 48:11
  But now it's like, Jim, the nearest branch to you is 2 hours
• 48:14
  away. So you're going to have my money
• 48:17
  and I have to drive 2 hours one way to get access to my money
• 48:21
  that I need to pay a bill to keep my my energy on or
• 48:26
  whatever. That's insane.
• 48:28
  So where we are at now is that a number of these thesas told me
• 48:32
  they're like, they're expecting regulations to come now with
• 48:34
  teeth for cyber resilience. And what sparked the
• 48:39
  conversation was identity security and not just about it's
• 48:44
  about CIA, right, right. The triad confidentiality,
• 48:47
  integrity and availability. And in particular these pieces
• 48:50
  are like David, I want to talk about availability with these
• 48:53
  identity systems. They've already some of them
• 48:55
  have already failed us before on security and now on the
• 49:00
  integrity, right. And now we're like, should we
• 49:04
  really look at availability and if, if auditors are going to
• 49:07
  come in and ask us about this, we got to have like better ways
• 49:10
  of doing this? So anyway, I'll stop there.
• 49:11
  I really want to hear what you have to say there, Jim, if
• 49:13
  you've heard anything about cyber resilience as it pertains.
• 49:16
  About it, I mean I, I think there are a lot of companies
• 49:19
  starting up to try to address this very big issue.
• 49:24
  What we've seen over the past 5-10 years is a major shift to
• 49:28
  cloud based services in the I am space is no different.
• 49:32
  And I say over the last five years almost every organization
• 49:36
  is leveraging some I am services in the cloud.
• 49:41
  I think there's sometimes the assumption that we move it up to
• 49:44
  the cloud. We don't need to back it up, we
• 49:47
  don't need to worry about restoring it.
• 49:50
  And Microsoft's never going to go down.
• 49:52
  And this isn't a knock on Microsoft.
• 49:54
  I think they do a great job. Of all the organizations in the
• 49:59
  world, they're probably I don't want.
• 50:02
  I don't know if this is true. I was going to say it's the
• 50:03
  least likely to go down, but it doesn't matter.
• 50:06
  It's not a 0% chance, right? No and.
• 50:08
  So are organizations building that Plan B are and here's
• 50:14
  another thing I've here's the well.
• 50:17
  Oh my God this gets me so excited this whole topic.
• 50:19
  We're nerds. My mind's going in all different
• 50:22
  directions, but I feel like sea levels in cyber, sea levels in
• 50:28
  information security and CIOs all came up in the 90's, the
• 50:36
  2000s. They came up when applications
• 50:40
  need to be backed up. And you'd hold periodic tabletop
• 50:45
  exercise where you restore, Maybe you go to sun guard,
• 50:48
  right? And you have like a whole bunch
• 50:49
  of hardware there and you have to restore your entire
• 50:51
  environment. You know what order you're going
• 50:53
  to do it in. I think the assumption that a
• 50:56
  lot of folks make I think is a big mistake is that like, like
• 51:03
  we don't have to worry about the cloud SAS applications right?
• 51:06
  Goes down. We get our apps running at sun
• 51:09
  guard and then we just point them out to our IDP or, or
• 51:13
  whatever. I I just think that's a that's
• 51:19
  the thing that would keep me up at night.
• 51:22
  I, yeah, I know. I mean it, it's, look, when you
• 51:26
  think about the practice of risk management, right, and risk
• 51:30
  quantification and risk calculation massive, right?
• 51:32
  We think we, we're not going to go into GRC here or anything
• 51:35
  like that, but there's some interesting innovation in GRC,
• 51:40
  the compute landscape, right? These Gen.
• 51:44
  AI Co pilots or bots that we're going to be having.
• 51:49
  So we're just going to be good bots and bad bots.
• 51:50
  We're going to start to see that hit us like a tidal wave.
• 51:53
  So good machines, bad machines. There's also the notion of all
• 51:58
  of our data and everything else, right?
• 52:00
  Like what do we have? We need the data to, to, to, to
• 52:03
  fuel these Gen. AI engines and fuel these chat
• 52:05
  bots and all these things that we want to do, you know,
• 52:08
  automation and all this stuff needs actual good data.
• 52:12
  The landscape in my view, Jim, the digital landscape, digital
• 52:16
  identity, cyber threats, you know, the Gen.
• 52:20
  AI technology, all these things that are coming in is changing
• 52:23
  faster than our ability to model the risk period, full stop.
• 52:28
  So and there's and we don't have a choice, right?
• 52:31
  We don't have a choice. We can't throw our our hands in
• 52:32
  the air and say, well, I guess we're just not going to do any
• 52:35
  of this, You know, like it's, hey, machine identity is too
• 52:37
  complicated, Let's just not do it.
• 52:38
  There's too many systems. Let's not do it.
• 52:40
  No, Look, I think there's some really interesting innovators
• 52:43
  out there. I think there's a lot there's a
• 52:44
  big open field for innovation, absolutely, But there's also,
• 52:51
  you know what the organizations themselves have to have to deal
• 52:54
  with this. And so when we come back to
• 52:55
  cyber resilience, I think, you know, Satya Nadella talked about
• 53:01
  kind of like, I, I can't remember the name, so don't
• 53:04
  don't get mad at me here, but he talked about like some kind of
• 53:07
  on Prem flavors of Azure. And I was like, ah, I know where
• 53:10
  that's coming from. There's some customers that are
• 53:12
  just like, hey, look, you're right.
• 53:14
  It's not a zero risk that like Azure would go down.
• 53:17
  It could go down or me go down to my region or even my region
• 53:21
  might lose access to this service that has like.
• 53:24
  Can I interrupt you for one second?
• 53:26
  Yeah, of course, because I, I think it's not even that the
• 53:30
  availability zone or what however you want to call it,
• 53:33
  goes down. That's the old disaster.
• 53:36
  The new disaster is your admin plugs into the network.
• 53:40
  He is locked out from his computer, doesn't know what's
• 53:43
  going on, but it takes his credentials, logs into your, you
• 53:48
  know, this is all behind the scenes and no one even knows
• 53:50
  what's happening, logs into your critical IAM systems and starts
• 53:55
  just changing all your configurations to gibberish.
• 53:59
  And all of a sudden your IM systems don't work anymore.
• 54:03
  Yeah, isn't that wonderful? Or it goes into your database
• 54:06
  and deletes all your data. But there's that's the, that's
• 54:09
  the new disaster. And then what choice do you have
• 54:14
  to put to pay the ransom or hopefully be able to restore?
• 54:19
  So hopefully you're in a position where you can restore
• 54:24
  even if you decide to pay the ransom.
• 54:26
  Yeah, yeah, I, I, I, I think when we, I want to link this
• 54:29
  back to identity security, right?
• 54:31
  Because I think we've covered a lot of ground because if
• 54:33
  machines fall under that humans, partners, customers, all that
• 54:38
  and whether you, you know, aim to look at one, I, I don't think
• 54:41
  there's going to be 1, you know, big platform, at least today
• 54:44
  that's going to be able to do all that.
• 54:45
  That's a lot. That's a lot to do.
• 54:48
  And those are different things. But resilience, I think is a, is
• 54:52
  a, is a, is a concept and term that needs to be weaved in.
• 54:56
  So it's actually like resilient identity security.
• 54:59
  Because I think if, if you think about, if you think about a
• 55:02
  superhero like, you know, let's, let's just go with Superman or,
• 55:06
  or, or Superwoman, right? You know, or Wonder Woman,
• 55:09
  right? They're like, you think about
• 55:11
  their superpowers, right? They're, they're not just strong
• 55:15
  and, you know, they not only run fast and do all those things,
• 55:18
  but they're also resilient. They can take a lot of hits and
• 55:23
  this game of identity security, unlike I am, it's more of like a
• 55:29
  boxing match. And I don't know any boxing
• 55:33
  match or any kind of fight where the the, the, the, the
• 55:40
  individual that won the fight didn't get punched.
• 55:43
  Of course they're going to get punched.
• 55:44
  So you. Didn't know like Tyson fight did
• 55:47
  you? Oh, I couldn't watch it.
• 55:49
  I couldn't watch it. I tried.
• 55:50
  I tried, but I was like, you know, sometimes I go ahead.
• 55:53
  No, no, no, no. But sometimes you just want to
• 55:55
  see like people like that. It's like, hey, I have memories
• 55:57
  and I don't want them to just like leave it as is, right?
• 56:02
  You know, before, like some people say, come on, man.
• 56:04
  It's just like, like throw in the towel.
• 56:05
  Like don't throw in the towel, but know, know your role.
• 56:07
  Like know like you're at the point where you should be a
• 56:10
  mentor and advisor and like you're not in the field anymore,
• 56:14
  you know, anyway. But what I was trying to say
• 56:17
  there, Jim, is is that resilience is something that is
• 56:20
  a is a characteristic that has to be deeply a part again of
• 56:25
  that concrete and steel foundation.
• 56:27
  So it has to be resilient. So it can take an earth your
• 56:29
  house using it that analogy again, the house can take an
• 56:33
  earthquake. It's got that concrete and steel
• 56:35
  foundation of identity security and there's an outage with your
• 56:39
  with one authentication system and one cloud environment.
• 56:42
  Well, if it's deployed in an active, active hot swap type
• 56:46
  scenario, OK, that's gone down for whatever reason.
• 56:49
  Now it flips over to the other. The other thing too, and this
• 56:53
  was the big thing that I've, I've kind of come to realize and
• 56:57
  look, I'll like Full disclosure too with the organization I work
• 57:00
  with, Transmit Security today transmits, you know, a part of
• 57:05
  these conversations I've been having with folks on identity
• 57:08
  resilience is also about like what keeps you up at night?
• 57:11
  And they're like, well, given some of the high profile IM
• 57:15
  breaches and outages that happened or last year and the
• 57:18
  year before, we recognize that IM is critical infrastructure.
• 57:23
  That's kind of what I was alluding to with, you know,
• 57:24
  these banks taking up branches and stuff.
• 57:27
  If those identity systems go down or any part of that supply
• 57:30
  chain of your identity system goes down.
• 57:33
  Now, if you're using it for both workforce and customer and then
• 57:36
  it goes down as we would say in Canada, 'cause I'm Canadian,
• 57:39
  you're host 'cause now, like now maybe your employees can access
• 57:42
  everything. But at the crowd strike Bree
• 57:46
  outage, all these things kind of came and these, these these
• 57:48
  seesaws are like, hey, and risk officers.
• 57:52
  We need a way to like almost wrap our identity systems in
• 57:55
  something and if it goes down to flip over to something else,
• 57:59
  right? And so I brought that to kind of
• 58:01
  our team at transmit and just say, Hey, look, as, as someone
• 58:04
  who's basically like a field Siso effectively, or, or that's
• 58:09
  one hat I wear. You know, interviewing these
• 58:11
  folks, they're like, that's one thing that they would see.
• 58:14
  Maybe they won't get rid of like one of their, you know, if it's
• 58:16
  ping, if it's Octa or whatever that or Microsoft's, they're
• 58:19
  like, we're not, we don't want to like necessarily RIP them
• 58:21
  out, but they need something to wrap around them so that if it,
• 58:24
  if something happens and you know, it's not their fault or
• 58:27
  whatever, but the risk isn't 0, you know, no one's perfect
• 58:31
  things happen. You know, tidal wave could
• 58:33
  happen. They could literally take out a
• 58:34
  critical data center. And maybe that was something we
• 58:36
  were relying on. We got to flip over to something
• 58:39
  else. And we can't necessarily, as I
• 58:42
  think you really, really well put it out.
• 58:44
  And I've been guilty of this too, the shared responsibility
• 58:48
  model, right? So I go, well, hey, you know,
• 58:51
  Microsoft or the CSP or whomever and it is, is, is, you know,
• 58:57
  they're going to take care of network security, they're going
• 58:59
  to take a physical security and all this and I don't have to
• 59:01
  worry about all that. OK, that's fine.
• 59:04
  Like that's why you're relying on the cloud.
• 59:05
  But I think what's happening now, Jim, is that we've been
• 59:09
  using cloud environments long enough and we're still learning.
• 59:13
  And one of one of I think the, the, the major learnings now is
• 59:16
  like, you got to have a backup of the backup and you have to
• 59:19
  have a plan, you know, to, to override something that a
• 59:23
  failure that might happen. And again, I'm not picking up
• 59:25
  Microsoft. They're, they're, they've done
• 59:27
  an amazing job. It's just that they're quite
• 59:30
  prominent. But this applies to Google and
• 59:31
  Amazon and any other CSP that's out there.
• 59:34
  They can talk until they're blue in the face about the things
• 59:37
  that they have. And that's great.
• 59:38
  But I think what these CSS are saying is like they want a
• 59:41
  little more control over their own destiny.
• 59:44
  And those IM failures that happened in the past, they're
• 59:47
  like, you know, some of them might either DCS that might
• 59:50
  either move away from them over time or they might say we're
• 59:53
  going to keep them in, but do we just like put more compensating
• 59:57
  controls around them? And so that's what we're hearing
• 59:59
  with. Identity security breaks down.
• 1:00:02
  We've been talking about and somebody goes in, they look like
• 1:00:07
  a legit user, and they wipe out all of your configurations.
• 1:00:11
  Whose fault is that? Is that your service provider's
• 1:00:16
  fault? Yeah.
• 1:00:18
  You logged in with the credentials that you set up the
• 1:00:21
  security settings for. The person knew the secret,
• 1:00:25
  maybe was able to respond to the multi factor authentication and
• 1:00:30
  then change all your settings. You know, can you restore old
• 1:00:35
  settings? Like, I don't know, you better
• 1:00:38
  understand. I mean, if you're going to go
• 1:00:41
  and spend 1,000,000 bucks or more on a software as a service
• 1:00:45
  for your security and it's a major component, something you
• 1:00:49
  need to have working to keep your business operational, you
• 1:00:54
  better know what you're going to do in that scenario.
• 1:00:56
  To me, that's the modern day disaster.
• 1:00:58
  It's either a ransomware event or some type of event where
• 1:01:03
  somebody's looking to do damage. It's it's not the earthquake,
• 1:01:07
  it's not the tidal wave. Those things can be easily, I
• 1:01:11
  say easily, but you look at like, you know, your, your
• 1:01:15
  modern platform as a service and you availability zones that just
• 1:01:20
  should take care of the earthquake scenario.
• 1:01:22
  You use West Coast and East Coast, or somewhere in between,
• 1:01:27
  or a couple different parts of the world, and all those things
• 1:01:30
  can be mitigated pretty pretty easily, or mitigated with money.
• 1:01:37
  Yeah, yeah. And I and I think there's no,
• 1:01:39
  yeah, there's no perfect solution, but you're right.
• 1:01:41
  I think you can at least say there's something you can do
• 1:01:43
  about it. But I, I, I think there's a
• 1:01:46
  distinction of this scenario you're saying is like there's
• 1:01:50
  resilience as in terms of the ability to, and this comes back
• 1:01:56
  to true identity security. And what you said earlier on in
• 1:01:58
  the podcast about is this, Jim, is this, is this his behavior?
• 1:02:03
  Is he, you know, all of these things.
• 1:02:05
  And if something looks weird, you can do something, you either
• 1:02:08
  stop the access or, or see what's going on.
• 1:02:09
  Actually, I'll, I'll tell you a very quick story.
• 1:02:12
  I mentioned the research, the one of the last research,
• 1:02:14
  another I, I wrote Eckartner was about ransomware and how it's
• 1:02:17
  not a malware problem. It's a data, data and identity
• 1:02:21
  access problem. And, and the data source behind
• 1:02:25
  that was it was several interviews, but there was like
• 1:02:30
  30 clients, practitioners I interviewed and all of them, and
• 1:02:36
  I mean, we're talking like over like, you know, the, the, it's
• 1:02:38
  like 30 out of a lot of people, but these were 30 people that
• 1:02:42
  successfully stopped ransomware. They did it because they were
• 1:02:46
  using data access governance tools.
• 1:02:49
  But how those tools, you know, some of them monitored user
• 1:02:53
  behavior. And in in the case what happened
• 1:02:56
  over and over again was actually Veronis.
• 1:02:57
  So I'll do a shout out to Veronis.
• 1:02:59
  I don't have any, you know, stake in the game here with
• 1:03:01
  Veronis. I'm just saying like they were a
• 1:03:03
  tool that I encountered. And so they had two ways, right?
• 1:03:07
  So one, they would do like right size access.
• 1:03:09
  So Veronis had the ability to, you know, have hooks in the
• 1:03:13
  kernel to look at file access, read and write.
• 1:03:16
  And what they would do is like, OK, first of all, I can say, OK,
• 1:03:18
  Jim, is this particular user not just from an identity governance
• 1:03:23
  standpoint, from a data lens, I can like, even though we might
• 1:03:27
  have have access to the SharePoint site, which has 100
• 1:03:30
  files in there. I could say his identity allows
• 1:03:34
  him to get into SharePoint based on it's, you know, on his, on
• 1:03:37
  his, you know, on, on the role of the group you're in.
• 1:03:42
  But maybe Jim shouldn't have access to the, let's just say
• 1:03:45
  1000 files that are in that site.
• 1:03:47
  Maybe he only needs access to 100 and we can, we can exercise
• 1:03:52
  just in time type principles and have that programmatic
• 1:03:55
  framework. So he could ask maybe David's
• 1:03:58
  permissions, let's say I own that to get access to certain
• 1:04:01
  files in there. But we know on a day-to-day
• 1:04:03
  basis, he probably only needs access to that 100.
• 1:04:05
  OK, so that was what I what I framed in the research known as
• 1:04:08
  like a static approach, and that's a good one.
• 1:04:11
  It's called right size access. That's number one.
• 1:04:14
  But the killer feature where they caught the ransomware over
• 1:04:17
  and over again. And these were clients that were
• 1:04:19
  big customers, Jim, like they've had the best of breed tools
• 1:04:24
  envious of, you know, lots of others with their budgets and
• 1:04:27
  their teams and like having like several thousand IT people and
• 1:04:31
  like security people. Like all we read team we
• 1:04:33
  tabletop ransomware still got in.
• 1:04:36
  None of the other tools caught it.
• 1:04:38
  How they caught it was the second piece they started
• 1:04:42
  seeing. Wait a minute.
• 1:04:43
  Jim normally because we baseline him, Jim normally only accesses,
• 1:04:48
  let's just use that SharePoint site.
• 1:04:49
  He only accesses maybe like 5 files an hour, right?
• 1:04:55
  But for some reason he was accessing 10,000 files in less
• 1:04:58
  than 5 minutes. OK, now that could be a good
• 1:05:01
  bot. But that's another topic, right?
• 1:05:03
  But at least for what they saw that was that was highly
• 1:05:07
  suspect. So what they did was they
• 1:05:09
  stopped, they paused the process and then they investigated and
• 1:05:12
  it was ransomware. So this is what happened.
• 1:05:16
  Not all the 30, but some of them.
• 1:05:17
  The ones that did the right size access #1 they, the ransomware
• 1:05:22
  went on to Jim's machine and it leveraged Jim's rights and
• 1:05:25
  entitlements. So everything Jim has access to,
• 1:05:28
  his machine identities related to him and all the accounts and
• 1:05:32
  human identities you have related to, that's what the
• 1:05:35
  ransomware used. And it encrypted everything it
• 1:05:37
  had access to. Now, because some of them did
• 1:05:40
  right size access saying that SharePoint site, it only
• 1:05:42
  encrypted part of the 100 files. But then the second piece of the
• 1:05:48
  behavior kicked in and it said, let's stop this because it's
• 1:05:51
  weird. It encrypted a lot of things,
• 1:05:54
  but it didn't, it didn't get to the keys of the Kingdom.
• 1:05:58
  And they were able to see like, oh, it encrypted a whole range
• 1:06:00
  of things and and then it stopped.
• 1:06:02
  So the epiphany there was like, if you're looking, if you do
• 1:06:06
  right size access that shrinks your tax surface 1/2.
• 1:06:11
  If you're looking at behaviour, you can now see like going back
• 1:06:15
  again to the concern you have Jim with, with resilience and
• 1:06:18
  outages is like, wait a minute, why is why is he suddenly going
• 1:06:21
  into the IAM system and changing like changing things or why, why
• 1:06:25
  is he deleting things or why are they doing so?
• 1:06:27
  Let's just stop this. And maybe there's a business
• 1:06:30
  reason for it legitimate, but we're going to stop this and get
• 1:06:33
  in the way of productivity for a moment because the risk profile
• 1:06:38
  justifies us stopping it. I mean, this is just don't do
• 1:06:41
  that today, Unfortunately, I think they're getting there.
• 1:06:45
  Part of the issue is education knowledge.
• 1:06:48
  The other part is, you know, again, great power comes great
• 1:06:53
  responsibility. I think some of the cyber
• 1:06:55
  security stacks are have massive holes here.
• 1:06:59
  And I think the IM providers right coming back to them.
• 1:07:03
  And again, yes, I'm picking on you.
• 1:07:04
  I, I don't care. Like we can talk about it.
• 1:07:07
  I, I, I, I think we need to have this discussion as an industry
• 1:07:12
  that I am is productivity based. It's not security.
• 1:07:15
  And I know we're trying to make these efforts, but I think for
• 1:07:18
  some of the providers that are out there, the journey to
• 1:07:21
  identity security is going to not be as difficult.
• 1:07:24
  But for, for others it might be. I'm not going to name names, I'm
• 1:07:27
  not going to get into that. That's irrelevant.
• 1:07:29
  I'm trying to just say like the market needs to start to think
• 1:07:32
  about evolving this way anyway, I'll stop there.
• 1:07:36
  I know there's like so many things we touched on and.
• 1:07:39
  I really appreciate it and I hope that the listeners kind of
• 1:07:44
  appreciate. We went a little bit longer than
• 1:07:46
  normal and we'll call it there, but this is a great
• 1:07:50
  conversation. It wouldn't be the identity at
• 1:07:54
  the center if we didn't have a little bit of a lighter note.
• 1:07:57
  And I think you're the perfect guest for a question I've been
• 1:08:00
  hanging on to for a long time. Here it goes, David.
• 1:08:04
  You have to design the perfect trail mix, but you can only
• 1:08:09
  select four ingredients. I'm asking you what are the four
• 1:08:13
  ingredients and what is 1 ingredient that does not make it
• 1:08:18
  into your trail mix no matter how many ingredients you can you
• 1:08:23
  can choose. Oh this is a good question.
• 1:08:26
  It does remind, if you watch Curb Your Enthusiasm, it reminds
• 1:08:29
  me of one episode where he had David Schwimmer on and David
• 1:08:33
  Schwimmer, you know, from friends, his dad had a trail mix
• 1:08:36
  company and Larry David was looking at the packages and he,
• 1:08:39
  he was like, I don't like the ratio of raisins to cashew.
• 1:08:44
  You know, I think he had way more raisins.
• 1:08:46
  I think I knew there was like 3 cashews.
• 1:08:47
  That was totally Larry David. It was a Larry David type
• 1:08:50
  question. He's like, hey, I've noticed
• 1:08:52
  that you're a little bit stingy on the cashew allotment.
• 1:08:56
  Anyway, that's a great question and just for the audience, so
• 1:09:00
  they know total surprise, OK, I did not know that this question
• 1:09:05
  was coming at me. Look, you know, I'm a health
• 1:09:08
  nut, Ching. Anyway, I would say cashews,
• 1:09:17
  walnuts, because they're both very good for you.
• 1:09:21
  I would put in maybe some pumpkin seeds because they're
• 1:09:25
  very good for digestion and omegas and and whatnot.
• 1:09:29
  And then, you know, you need to have something sweet in there,
• 1:09:32
  get some sugars or, or whatever. I would say raisins just because
• 1:09:36
  I, I really like raisins. Ideally, I would probably.
• 1:09:40
  I'm sorry, go ahead. You are a health nut man.
• 1:09:43
  No chocolate, huh? Well, and that's I'll get to
• 1:09:46
  that in a second. That was the thing I you said
• 1:09:48
  not to include and I'll give you a bonus one there too.
• 1:09:53
  But I was going to say I instead of raisins, I would ideally
• 1:09:56
  would have dates. But the issue with dates is
• 1:09:58
  they're not that small. So trail mix raisins, cashews,
• 1:10:03
  pumpkin seeds and walnuts. Walnuts are really good for you.
• 1:10:08
  OK, what I wouldn't include you hit it Chocolate.
• 1:10:12
  Not because I don't like it. I love chocolate.
• 1:10:15
  I just figured like I'm just I'm a health nut.
• 1:10:18
  So I'm trying to stay more on the healthy side and not as many
• 1:10:21
  sugars. And if you're going to have some
• 1:10:22
  sugar, at least with the raisins, you're getting some
• 1:10:24
  fiber. And there's some other benefits
• 1:10:27
  as well with the raisins and especially with dates, if you
• 1:10:30
  can manage that. And I think the bonus would be
• 1:10:32
  like cranberries, like the dried cranberries, again, I like them.
• 1:10:36
  You're going to get some of the fiber benefits, but.
• 1:10:39
  They're sugar bombs. Exactly.
• 1:10:40
  They're just sugar bombs. So it's sugar is the culprit
• 1:10:43
  that I'd probably try and eliminate.
• 1:10:45
  But in trail mix, you want to have some sugar in there to give
• 1:10:47
  you a little bit of an energy pump.
• 1:10:48
  So anyway, hopefully that that that that was a good answer.
• 1:10:51
  I don't know. That's a good, it is a good
• 1:10:54
  answer. And it's like such a personal
• 1:10:56
  thing for me. There's no pistachios in my
• 1:11:00
  trial mix. That was like the one ingredient
• 1:11:03
  I think would ruin the flavor of the entire trial mix.
• 1:11:07
  Like I just, I hate pistachios and I know that's going to be
• 1:11:12
  very unpopular. Wow.
• 1:11:15
  Yeah. Well, I love them, but I'm not
• 1:11:17
  going to get in. I, you know, and I respect, I
• 1:11:19
  respect your, I respect how you can, you know, not like it, but
• 1:11:24
  that's OK. We we don't need to get it in or
• 1:11:26
  even. I'm not really a a dried fruit
• 1:11:28
  person either. Like dried apricots, I don't
• 1:11:32
  like them. Dried bananas don't like them.
• 1:11:36
  Dried mangoes if I was to what's that?
• 1:11:39
  Dried mangoes. Dried mangoes?
• 1:11:41
  I'm not sure. Oh, they're good.
• 1:11:43
  I don't think I would like them. OK, is it the texture?
• 1:11:46
  Is it the taste? It's it's the texture.
• 1:11:49
  I mean, I like fruit. OK.
• 1:11:51
  Yeah, it's the texture. So for me, I, I'm kind of like
• 1:11:55
  you, I, I want to have a health aspect, but then there's part of
• 1:12:00
  me that doesn't care. And because like, assumably
• 1:12:04
  while you're eating the trail mix, you're not just sitting and
• 1:12:06
  watching TV, right? You're up and moving and you
• 1:12:10
  know you're going to burn some calories, so you want to have
• 1:12:13
  the fat because that's going to give you your long term energy.
• 1:12:16
  But you also, I think you want it to taste good and you want
• 1:12:20
  the sugar. So I pick two nuts, chocolate,
• 1:12:26
  which is going to be M&M's. I think it's the only type that
• 1:12:28
  oh be pretty sure is not going to melt.
• 1:12:35
  I pick dried cranberries over raisins.
• 1:12:37
  You know, part of the advantage here, David, is I've had time to
• 1:12:40
  think about this. So thinking one of the.
• 1:12:42
  Fair. Unfair.
• 1:12:44
  No. Go ahead.
• 1:12:44
  One of the nuts has got to be almonds, I think, and I know I
• 1:12:48
  say that weird for some people almonds, but that would be one
• 1:12:53
  of the nuts and then the other might be good old peanuts.
• 1:12:59
  But I've also thought a wild card instead of nuts could be
• 1:13:02
  like, you know, the sesame sticks that are in a lot of
• 1:13:06
  like, yes, yeah, Chex mix kind of thing.
• 1:13:09
  So that could give you a little more extra crunch.
• 1:13:13
  I think some crunch would be nice.
• 1:13:14
  So I'm going to go with that sesame sticks, almonds, M&M's
• 1:13:20
  and cranberries. But as Larry David would say,
• 1:13:25
  it's got to be in the right ratio.
• 1:13:26
  And you got to have the right ratio, you know, you got it.
• 1:13:28
  You got a too much, too much of any one of those will throw it
• 1:13:31
  off and too little of any one of those will throw it off.
• 1:13:34
  So you got to have the right balance and and that's, and I'd
• 1:13:37
  look, I'm not a trail mix expert, but yeah, I agree with
• 1:13:40
  you because I think the IT sounds like for you, I was gonna
• 1:13:43
  say like fruit, like the actual, like if you an actual mango, an
• 1:13:46
  actual like apricot, that might be the the better way,
• 1:13:49
  especially you don't like the texture.
• 1:13:50
  But yeah, the advantage with the dried fruits and all the these
• 1:13:53
  dried goods is that, you know, for you and I who travel, like
• 1:13:56
  that's something you can throw in your bag.
• 1:13:58
  And if you're on the plane and there's too much turbulence and
• 1:14:01
  they're not serving anything as has happened before, you know,
• 1:14:03
  and sat for several hours flying with no food, no water, no
• 1:14:06
  nothing. But luckily I had my trusty
• 1:14:08
  water bottle and they think I had a little bag of cashews,
• 1:14:11
  didn't have raisins, but like I at least had like a little thing
• 1:14:14
  of cashews in my bag that I could at least snack on, you
• 1:14:18
  know, like that kind of stuff. So that's the nice thing with
• 1:14:20
  it. And then there's nothing to like
• 1:14:22
  really throw out other than the bag that said, you know, so, but
• 1:14:25
  hey, no, that was a good question.
• 1:14:27
  So, but you know, it's good. I thought you'd be perfect for
• 1:14:32
  that. So David, thank you so much for
• 1:14:34
  coming on the show. I will see you in a couple of
• 1:14:37
  weeks. Now we got the Gartner I am
• 1:14:38
  Summit. Remember, if you haven't
• 1:14:40
  registered yet, we have a discount code IDAC 375.
• 1:14:45
  Definitely encourage folks to use it will be in the show notes
• 1:14:49
  along with the link to get to the registration page.
• 1:14:53
  You find David on LinkedIn. He's always open to connect.
• 1:14:57
  He works for Transmit Security, which I think you have Transmit
• 1:15:00
  security.com. We had the IDAC podcast, have
• 1:15:04
  idacpodcast.com. You always find us there or on
• 1:15:10
  LinkedIn. Jeff and I are on LinkedIn.
• 1:15:12
  We also have an identity to center page, which we would love
• 1:15:15
  it if you'd go out and follow. If you listen to the podcast on
• 1:15:19
  a pod, you know, audio only format like Apple Podcasts or
• 1:15:23
  Spotify, please go out and give us a five star rating, leave a
• 1:15:28
  review. It's always very much
• 1:15:29
  appreciated. That helps other folks find the
• 1:15:31
  show. We're also on YouTube, so all
• 1:15:34
  you have to do is go. idacpodcast.tv brings you right
• 1:15:38
  to our YouTube page. We'd love it if you would
• 1:15:39
  subscribe this, this video and others will be there that you
• 1:15:44
  can actually start to match faces with names and voices.
• 1:15:48
  I, I mean, I know since we've started doing it a lot more
• 1:15:52
  people recognize me at conferences and come up and say
• 1:15:55
  hi. If you are at Gartner pod,
• 1:15:57
  Gartner IM Summit, please look for me, look for Jeff, look for
• 1:16:02
  David. We always love to know the
• 1:16:04
  people that are listening to the podcast.
• 1:16:07
  So, and we really appreciate you devoting your time to listening
• 1:16:12
  to this podcast. We put all this effort in for
• 1:16:15
  you guys, the I am practitioners of the world, and we appreciate
• 1:16:19
  you more than you realize. So thank you and we'll talk to
• 1:16:22
  everyone on the next episode. You've been listening to
• 1:16:28
  Identity at the Center. We hope you've enjoyed the show.
• 1:16:32
  Make sure to like, rate and review, and we'll be back soon.
• 1:16:37
  But in the meantime, hit the website at
• 1:16:39
  identity@thecenter.com. See you next time on Identity at
• 1:16:45
  the Center.